CONFIGURING AND MANAGING NTFS SECURITY

1. Chapter 7 CONFIGURING AND MANAGING NTFS SECURITY

2. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY OVERVIEW • Understand the structure of NTFS security • Control access to files and folders by using permissions • Optimize access to files and folders by using NTFS best practices • Audit NTFS security • Troubleshoot access to files and folders

3. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY MASTER FILE TABLE (MFT)

4. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY SECURITY DESCRIPTORS

5. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY ACCESS CONTROL LISTS (ACLs) • Store access control entries (ACEs) • Assigned to security descriptor for file system object • Evaluated to control access to objects • There are two types of ACLs: • Discretionary ACL (DACL): Permissions • System ACL (SACL): Auditing

6. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY ACCESS CONTROL ENTRIES (ACEs) • Stored in ACLs (which are collections of ACEs, grouped by resource) • Consist of user or group SIDs with permission entries • Can be set for Allow, Deny, or Audit • Allow and Deny ACEs can exist in the same ACL • Audit ACEs are kept in SACLs • Deny ACEs override Allow ACEs

7. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY STANDARD NTFS PERMISSIONS

8. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY SPECIAL PERMISSIONS

9. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY PERMISSION INHERITANCE • Subfolders and files inherit permissions • Inheritance can be blocked • Blocking required for new permissions

10. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY COPYING OR MOVING NTFS OBJECTS

11. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY PLANNING NTFS PERMISSIONS • Consolidate data • Assign permissions to folders • Assign most restrictive permissions possible • Use groups for permission assignment • Avoid excessively blocking inheritance • Avoid the Deny ACE

12. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY ASSIGNING STANDARD PERMISSIONS

13. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY ASSIGNING SPECIAL PERMISSIONS

14. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY WHY CAN’T I CHANGE PERMISSIONS FOR THIS FOLDER?

15. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY TAKING OWNERSHIP OF FILES

16. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY CACLS.EXE

17. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY MULTIPLE NTFS PERMISSIONS • Sum of all ACEs for user or group • Most lenient permission is the effective permission • Deny overrides all

18. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY VIEWING EFFECTIVE PERMISSIONS

19. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY AUDITING NTFS ACCESS

20. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY DISCUSSION

21. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY SUMMARY • NTFS permissions work only on NTFS volumes. • Security descriptors are stored in the $Secure file. • ACLs list ACEs assigned to an object. • ACEs map users or groups to permissions. • Permissions are inherited by default. • Effective permissions are the sum of ACEs.

22. Chapter 7: CONFIGURING AND MANAGING NTFS SECURITY SUMMARY (CONTINUED) • Ownership cannot be “given.” • Deny ACEs override all other ACE types for a particular permission. • Avoid the Deny ACE to limit complexity.