NTFS Permissions¶
Group membership sets a blanket level of access. File permissions go finer: this folder is read-only for one group, this file is off-limits to everyone but two people. They're what stops an ordinary user from reading a folder they shouldn't.
Volumes must be NTFS¶
Permissions only exist on NTFS. A FAT32 volume has none; every file on it is readable and writable by everyone. Check (STIG WN11-00-000050):
Get-Volume | Select DriveLetter, FileSystemType
Convert without losing data: convert D: /fs:ntfs.
Read them¶
Right-click a file or folder → Properties → Security tab. Select a user or group; the boxes show what they can do.
| Permission | Allows |
|---|---|
| Full control | Everything below, plus changing permissions and taking ownership |
| Modify | Read, write, and delete. Not change permissions. |
| Read & execute | Open files, run programs |
| List folder contents | See file names (folders only) |
| Read | View a file and its attributes |
| Write | Change a file's contents. Not delete it. |
Each is Allow or Deny. Deny wins, so a user in two groups with conflicting settings is denied.
Change them¶
For a user or group already listed: select it → Edit → tick or untick → OK.
For one not listed: Edit → Add → type the name → Check Names → OK → set the boxes.
To remove an entry entirely: Edit → select → Remove.
What to look for¶
The usual flaw is permissions that are too generous.
- Everyone, Users, or Authenticated Users with Modify or Full control on a folder holding company data.
- A specific non-admin user with Full control on something sensitive.
- Loose permissions on system folders.
C:\Windows,C:\Program Files, andC:\Windows\System32\drivers\etcshould give Users Read & execute and nothing more. - Users able to write to a folder that scripts or services run from. Whatever they drop there runs with the service's privileges.
Example¶
The README says only the Finance group should access C:\Finance. The Security tab shows Users with Modify. Remove the Users entry, add Finance with Modify, leave Administrators with Full control and SYSTEM with Full control.