Which access control permissions allow you to change files and or folders?

Lab #2 - Assessment Worksheet

Using Access Control Lists to Modify File System Permissions on Windows Systems

Course Name and Number: ISSC342 Student Name: Benson K kungu Instructor Name: Peter Mylonakos Lab Due Date: June 14, 2015
Overview

In this lab, you used the Windows command-line utility, icacls.exe, to establish file level permissions following a set of access control requirements. You tested those permissions by remotely accessing the Windows server and attempting to modify files in the secured folders. You used screen captures to document the access control changes you made in this lab were properly applied.

Lab Assessment Questions & Answers

1. What is the principle of least privilege?
1. What is the principle of least privilege? The least privilege principle is when it’s provided the just the necessary access required to carry out a task.

2. What does ACL stand for and how it is used?

The ACL is the Access Control List. Can be used to allow or deny access to objects by user or groups

3. Why would you add permissions to a group instead of the individual?

When working with group you can keep it organized and if there are for example 100+ users and they need basically the same permissions, it’s time consuming if it’s done one by one. Windows Server have the option to create and manage groups permissions for better organization and less time consuming.

4. List at least three different types of access control permissions you can enable for a file using icacls.exe.

RX- Read and Execute Access M- Modify Access
F-Full Access

5. Which access control permissions allow you to change files and/or folders?

The Full access allows you to change files and/or folders.

6. If you don't remember the syntax when using icacls.exe, what command do you type to see the options?

The command is:

icacls /?

7. Without using the icacls.exe tool, how could you view and modify the privileges of the files or folders

Continue Reading

    NTFS is the default file system of the Windows operating system family, offering a wide range of advanced features such as journaling, compression, quotas, and much more. NTFS also offers a flexible security model, allowing administrators to control how users and groups can interact with folders and files. These interactions are controlled through the assignment of permissions.

    Basic and Advanced Permissions

    NTFS permissions are logically grouped into a series of six basic permissions, each of which is comprised of a specific set of advanced (special) permissions. These groupings make it easier to apply complimentary permissions to users and groups.

    PERMISSIONReadWriteList Folder ContentsRead & ExecuteModifyFull ControlTraverse Folder / Execute File

    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    List Folder / Read Data
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Read Attributes
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Read Extended Attributes
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Create Files / Write Data
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Create Folders / Append Data
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Write Attributes
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Write Extended Attributes
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Delete Subfolders and Files
    Which access control permissions allow you to change files and or folders?
    Delete
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Read Permissions
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Which access control permissions allow you to change files and or folders?
    Change Permissions
    Which access control permissions allow you to change files and or folders?
    Take Ownership
    Which access control permissions allow you to change files and or folders?

    Permissions can have different meanings depending on whether they're applied to folders or files. Let's start with the basic permissions.

    PermissionMeaning for FoldersMeaning for FilesReadPermits viewing and listing of files and subfoldersPermits viewing or accessing of the file’s contentsWritePermits adding of files and subfoldersPermits writing to a fileRead & ExecutePermits viewing and listing of files and subfolders as well as executing of files; inherited by files and foldersPermits viewing and accessing of the file’s contents as well as executing the fileList Folder ContentsPermits viewing and listing of files and subfolders as well as executing of files; inherited by folders onlyN/AModifyPermits reading and writing of files and subfolders; allows deletion of the folderPermits reading and writing of the file; allows deletion of the fileFull ControlPermits reading, writing, changing, and deleting of files and subfoldersPermits reading, writing, changing, and deleting of the file

    Now we'll further refine our understanding of the available advanced (also known as "special") permissions.

    • Traverse Folder / Execute File - Traverse Folder allows or denies moving through folders to reach other files or folders, even if the user has no permissions for the traversed folders (applies to folders only). Execute File allows or denies running program files (applies to files only).
    • List Folder / Read Data - List Folder allows or denies viewing file names and subfolder names within the folder (applies to folders only). Read Data allows or denies viewing data in files (applies to files only).
    • Read Attributes - Allows or denies viewing the attributes of a file or folder, such as read-only and hidden. Attributes are defined by NTFS file system.
    • Read Extended Attributes - Allows or denies viewing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary by program.
    • Create Files / Write Data - Create Files allows or denies creating files within the folder (applies to folders only). Write Data allows or denies making changes to the file and overwriting existing content (applies to files only).
    • Create Folders / Append Data - Create Folders allows or denies creating folders within the folder (applies to folders only). Append Data allows or denies making changes to the end of the file but not changing, deleting, or overwriting existing data (applies to files only).
    • Write Attributes - Allows or denies changing the attributes of a file or folder, such as read-only or hidden. Attributes are defined by NTFS.
    • Write Extended Attributes - Allows or denies changing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary by program.
    • Delete Subfolders and Files - Allows or denies deleting subfolders and files, even if the Delete permission has not been granted on the subfolder or file.
    • Delete - Allows or denies deleting the file or folder. If you do not have Delete permission on a file or folder, you can still delete it if you have been granted Delete Subfolders and Files on the parent folder.
    • Read Permissions - Allows or denies reading permissions of the file or folder, such as Full Control, Read, and Write.
    • Change Permissions - Allows or denies changing permissions of the file or folder, such as Full Control, Read, and Write.
    • Take Ownership - Allows or denies taking ownership of the file or folder. The owner of a file or folder can always change permissions on it, regardless of any existing permissions that protect the file or folder.

    Permission Inheritance

    By default, NTFS permissions for files and folders inherit the permissions of their parent folder. The primary purpose of file system permissions inheritance is to simplify administration. Without inheritance, administrators would need to specify permissions explicitly for each and every file and folder.

    There are cases, however, when an administrator will need to assign explicit permissions to a file system branch. This can be accomplished by disabling permissions inheritance for a given set of child objects (files or folders) and then assigning the desired permissions.

    Network Share Permissions

    Windows shares can be used to provide access to one or more folders via the network. Share permissions are distinct from NTFS permissions and take effect when the associated folder is accessed from a remote machine. Share permissions are also less granular than NTFS permissions, offering Read, Change, and Full Control access levels.

    What are the permissions that can be set on a folder or file?

    There are six standard permission types which apply to files and folders in Windows: Full Control. Modify. Read & Execute..
    create folders..
    add new files..
    delete files..

    Which Windows file permission allows you to change permissions of a file or folder?

    Read Permissions - Allows or denies reading permissions of the file or folder, such as Full Control, Read, and Write. Change Permissions - Allows or denies changing permissions of the file or folder, such as Full Control, Read, and Write.

    Which directory access right allows users to modify or delete files from a folder?

    Here are the basic types of access permissions: Full Control — Users can add, modify, move and delete files and directories, as well as their associated properties.

    Which access permission is applied on file folder?

    Permission Types There are basically six types of permissions in Windows: Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write. List Folder Contents is the only permission that is exclusive to folders. There are more advanced attributes, but you'll never need to worry about those.