Skip to content

NTFS Permissions

Group membership sets a blanket level of access. File permissions go finer: this folder is read-only for one group, this file is off-limits to everyone but two people. They're what stops an ordinary user from reading a folder they shouldn't.

Volumes must be NTFS

Permissions only exist on NTFS. A FAT32 volume has none; every file on it is readable and writable by everyone. Check (STIG WN11-00-000050):

Get-Volume | Select DriveLetter, FileSystemType

Convert without losing data: convert D: /fs:ntfs.

Read them

Right-click a file or folder → Properties → Security tab. Select a user or group; the boxes show what they can do.

Permission Allows
Full control Everything below, plus changing permissions and taking ownership
Modify Read, write, and delete. Not change permissions.
Read & execute Open files, run programs
List folder contents See file names (folders only)
Read View a file and its attributes
Write Change a file's contents. Not delete it.

Each is Allow or Deny. Deny wins, so a user in two groups with conflicting settings is denied.

Change them

For a user or group already listed: select it → Edit → tick or untick → OK.

For one not listed: Edit → Add → type the name → Check Names → OK → set the boxes.

To remove an entry entirely: Edit → select → Remove.

System folder defaults

The server STIG (WN22-00-000140 to 000160) says the root of the system drive, the Program Files folders, and C:\Windows must still carry their default permissions. An image can loosen them so a standard user can drop a file in C:\Windows\System32 or replace a program in Program Files, which is a privilege escalation waiting for the next administrator logon.

icacls C:\
icacls "C:\Program Files"
icacls C:\Windows

What the defaults look like: SYSTEM and Administrators with full control (F), Users with read and execute (RX), and on Program Files and Windows, NT SERVICE\TrustedInstaller with full control. On C:\ Authenticated Users have the ability to create folders and files in the root, and that's normal. What isn't normal: Everyone anywhere, Users with M (modify) or F, or a named user account. Remove the extra entry rather than rewriting the whole list:

icacls C:\Windows /remove:g Everyone
icacls "C:\Program Files" /remove:g Users /grant:r "Users:(OI)(CI)RX"

What to look for

The usual flaw is permissions that are too generous.

  • Everyone, Users, or Authenticated Users with Modify or Full control on a folder holding company data.
  • A specific non-admin user with Full control on something sensitive.
  • Loose permissions on system folders. C:\Windows, C:\Program Files, and C:\Windows\System32\drivers\etc should give Users Read & execute and nothing more.
  • Users able to write to a folder that scripts or services run from. Whatever they drop there runs with the service's privileges.

Example

The README says only the Finance group should access C:\Finance. The Security tab shows Users with Modify. Remove the Users entry, add Finance with Modify, leave Administrators with Full control and SYSTEM with Full control.

Try it

  1. Create a folder, give Everyone full control, read it with icacls, then fix it.
  2. Run icacls C:\Windows and read every entry.

Build it

An ntfs-audit.ps1 that runs icacls on the system directories and prints any line containing Everyone, Users with M or F, or an account that isn't a built-in.

Next

Inheritance