Windows Security · 2.8
📁 File Permissions (Windows)
Who can read, write, or run each file⏱ ~2 min
File permissions control which users can access, modify, or execute files and folders. Misconfigured permissions are a common vulnerability — giving 'Everyone Full Control' to sensitive folders is a serious security risk.
NTFS Permission Types
| Permission | What It Allows |
|---|---|
| Full Control | Read, write, delete, change permissions, take ownership — admin-level |
| Modify | Read, write, delete contents — but cannot change permissions or ownership |
| Read & Execute | Open files and run programs — no writing |
| List Folder Contents | See file/folder names — cannot open them |
| Write | Create new files/folders, change contents — but cannot delete |
| Read | View file contents and attributes only |
Setting Permissions via GUI
- •Right-click folder → Properties → Security tab
- •Click Edit to change existing permissions, or Advanced for inheritance and ownership
- •Use Add to add a new user/group with specific permissions
- •Deny takes precedence over Allow — use carefully
icacls — Command Line Permissions
cmd
# View permissions on a foldericacls C:\sensitive # Grant user 'alice' Read & Execute on a folder and its contentsicacls C:\sensitive /grant alice:(OI)(CI)(RX) # Remove all permissions for user 'badactor'icacls C:\sensitive /remove badactor # Reset to default inherited permissionsicacls C:\sensitive /reset # Key permission flags:# (F)=Full (M)=Modify (RX)=Read+Execute (R)=Read (W)=Write# (OI)=Object Inherit (CI)=Container Inherit (I)=InheritedSharing Drives — Disable Unnecessary Shares
- •Open fsmgmt.msc → Shares tab to see all shared folders
- •Right-click an unauthorized share → Stop Sharing
- •Never share an entire drive (C:) — gives all network users full file access
- •Default admin shares (C$, ADMIN$, IPC$) are normal and should not be removed
🧠Quick Checkfirst try = +5 XP
Which command displays or modifies Windows file permissions (ACLs)?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days