NTFS permissions, a technology that’s a core part of Vista’s security system. Using this feature, you can specify exactly which co-workers are allowed to open which files and folders on your machine. In fact, you can also specify how much access each person has. You can dictate, for example, that Gomez and Morticia aren’t allowed to open your Fourth-Quarter Projections spreadsheet at all, that Fred and Ginger can open it but not make changes, and George and Gracie can both open it and make changes.
Your colleagues will encounter the permissions you’ve set up like this in two different situations: when tapping into your machine from across the network, or when sitting down at it and logging in using their own names and passwords. In either case, the NTFS permissions you set up protect your files and folders equally well.
Using NTFS permissions is most decidedly a power-user technique because of the added complexity it introduces. Entire books have been written on the topic of NTFS permissions alone.
You’ve been warned.
Setting Up NTFS Permissions
To change the permissions for an NTFS file or folder, you open its Properties dialog box by right-clicking its icon, and then choosing Properties from the shortcut menu. Click the Security tab.
Specify the person
The top of the Security tab lists the people and groups that have been granted or denied permissions to the selected file or folder. When you click a name in the list, the Permissions box at the bottom of the dialog box shows you how much access that person or group has.
The first step in assigning permissions, then, is to click Edit. You see an editable version of the dialog box.
If the person or group isn’t listed, click the Add button to display the Select Users or Groups dialog box, where you can type them in.
Specify the permissions
Once you’ve added the users and groups you need to the list on the Security tab, you can highlight each one and set permissions for it. You do that by turning on the Allow or Deny checkboxes at the bottom half of the dialog box.
The different degrees of freedom break down as follows (they’re listed here from least to most control, even though that’s not how they’re listed in the dialog box):
List folder contents, available only for folders, means that the selected individuals can see (but not necessarily open) the files and folders inside. That may sound obviousbut believe it or not, if you don’t turn on this option, the affected people won’t even be able to see what’s in this folder. The folder will just appear empty.
Read lets people examine the contents of the file or folder, but not make changes. (They can also examine the permissions settings of these files and foldersthe ones that you’re setting up right now.)
Read & execute is a lot like Read, except that it also lets people run any programs they find inside the affected folder. When applied to a folder, furthermore, this permission adds the ability to traverse folders. (Traversing means directly opening inner folders even when you’re not allowed to open the outer folder. You might get to an inner folder by double-clicking a shortcut icon, for example, or by typing the folder’s path into the Address bar of a window.)
Groups and Permissions
Once you understand the concept of permissions, and you’ve enjoyed a thorough shudder contemplating the complexity of a network administrator’s job (six levels of permissions x thousands of files x thousands of employees = way too many permutations), one other mystery of Windows will fully snap into focus: the purpose of groups, introduced on page 683.
On those pages, you can read about groups as canned categories, complete with predefined powers over the PC, into which you can put different individuals to save yourself the time of adjusting their permissions and privileges individually. As it turns out, each of the ready-made Vista groups also comes with predefined permissions over the files and folders on your hard drive.
If you belong to the Users group, you have the List Folder Contents permission, which means that you can see what’s in the Windows folder; the Read permission, which means that you can open up anything you find inside; and the Read & Execute permission, which means that you can run programs in that folder (which is essential for Windows Vista itself to run). But people in the Users group aren’t allowed to change or delete anything in the Windows folder, or to put anything else inside. Windows Vista is protecting itself against the mischievous and clueless.
Members of the Administrators group have all of those abilities and morethey also have Modify and Write permissions, which let them add new files and folders to the Windows folder (so that, for example, they can install a new software program on the machine).
When Permissions Collide
If you successfully absorbed all this information about permissions, one thing should be clear: people in the Administrators group ought to be able to change or delete any file in your Windows folder. After all, they have the Modify permission, which ought to give them that power.
In fact, they can move or delete anything in any folder in the Windows folder, because the first cardinal rule of NTFS permissions is this:
NTFS permissions travel downstream, from outer folders to inner ones
In other words, if you have the Modify and Write permissions to a folder, then you ought to have the same permissions for every file and folder inside it.
But in Windows XP, there was something called the Power Users group. It’s been turned off in Vista, but for the sake of illustration, let’s say you’re part of it. You’d find that you can’t, in fact, delete any files or folders in the Windows folder. That’s because each of them comes with Modify and Write permissions turned off for Power Users, even though the folder that encloses them has those permissions turned on.
Why would Microsoft go to this trouble? Because it wanted to prevent people in this group from inadvertently changing or deleting important Windows filesand yet it wanted these people to be able to put new files into the Windows folder, so they can install new programs.
This is a perfect example of the second cardinal rule of NTFS permissions:
NTFS permissions that have been explicitly applied to a file or folder always override inherited permissions
Here’s another example: Suppose your sister, the technical whiz of the household, has given you Read, Write, Modify, Read & Execute, and List Folder Contents permissions to her own Documents folder. Now you can read, change, or delete every file there. But she can still protect an individual document or folder inside her Documents folderthe BirthdayPartyPlans.doc file, for exampleby denying you all permissions to it. You’ll be able to open anything else in there, but not that file.
Believe it or not, NTFS permissions get even more complicated, thanks to the third cardinal rule:
Permissions accumulate as you burrow downward through subfolders
Now suppose your sister has given you the Read and List Folder Contents permissions to her Documents foldera “look, but don’t touch” policy. Thanks to the first cardinal rule, you automatically get the same permissions to every file and folder inside Documents.
Suppose one of these inner folders is called Grocery Lists. If she grants you the Modify and Write permissions to the Grocery Lists folder so you can add items to the shopping list, you end up having Read, Modify, and Write permissions for every file in that folder. Those files have accumulated permissionsthey got the Read permission from Documents, and the Modify and Write permissions from the Grocery Lists folder.
Because these layers of inherited permissions can get dizzyingly complex, Microsoft has prepared for you a little cheat sheet, a dialog box that tells you the bottom line, the net resultthe effective permissions. To see it, follow these steps:
1. Click the Advanced button on the Security tab.
The Advanced Security Settings dialog box appears.
2. Click the Effective Permissions tab; click Select.
Now you see the same Select User or Group dialog box you saw earlier when you were creating permissions.
3. Click the user or group whose effective permissions you want to see, and then click OK.
You now see checkmarks next to the permissions that are in effect, taking into account folder-permission inheritance and all other factors, for the user or group of that particular file or folder
