NTFS Effective Permissions Question

Okay, say you have a question that says: Sales group has permission Read on Sales Folder. Your user account has been given the permission Write. What are your effective permissions? And if the choices for answers include: Read, Write, Read and Write, Full Control.

The correct answer it said was: Read and Write. I said it was just Write. Because it is already applied that Write also has the Read permissions, so couldnt the answer me just Write, instead of Read and Write?

Thanks for your guys help.

PS: I need response fast, i'm going to take my 70-270 tomorrow afternoon, and i want to be peace at mind, that i know the right answer to this type question before i go take exam

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

mobri09

First of all, NTFS permissions are cumulative. This means that a user's effective permissions are the result of combining the user's assigned permissions and the permissions assigned to any groups that the user is a member of. For instance, if a user is assigned Read access to a specific file, and a group that the user account is a member of has the Write permissions assigned, the user is allowed the Read and Write NTFS permission to that file.

check this out also
http://www.windowsitlibrary.com/Content/592/1.html

win2k8

I know but why would it be Read and Write, and not just Write?

Does Write permission not also include the Read permissions?

Say the question said a user had Read and also Modify permissions on the folder, and what are the effective permissions, in this case why would it be just Modify not Read and Modify ?

zenboy

that is correct. Just modify. I don't think you should have this problem on the exam. My exam didn't have read+modify as the answer, just modify.

eurotrash

the difference is that Modify includes the Read, Read & Execute, and Write permissions.
Write on the other hand doesn't include Read, so even if you have write access to the file, you won't be able to read it.

12mcken

_omni_ wrote:

the difference is that Modify includes the Read, Read & Execute, and Write permissions.
Write on the other hand doesn't include Read, so even if you have write access to the file, you won't be able to read it.

According to the infomation listed on Tech Exams website. The WRITE permission does include READ . My first response would be READ & WRITE for effective permissions , but after looking at the below response , I'm not so sure.

http://techexams.net/technotes/xp/administration.shtml

One of the main reasons to use NTFS is the possibility to assign permissions for individual files and folders. Each file and folder on an NTFS volume contains an Access Control List (ACL). This list is filled with entries for groups and individual user accounts and their corresponding permissions. When a user tries to access a resource, Windows XP checks the ACL if the user is listed and what level of permission is assigned.

The following permissions can be assigned for files and folders:

Read Allows user read files and list the contents of folders, subfolders and volumes, including the attributes, permissions and ownership of the files.

Write Allows the same as Read and additionally allows the user to modify and create files and (sub-)folders as well as changing attributes.

sprkymrk

12mcken wrote:

_omni_ wrote:

the difference is that Modify includes the Read, Read & Execute, and Write permissions.
Write on the other hand doesn't include Read, so even if you have write access to the file, you won't be able to read it.

According to the infomation listed on Tech Exams website. The WRITE permission does include READ . My first response would be READ & WRITE for effective permissions , but after looking at the below response , I'm not so sure.

http://techexams.net/technotes/xp/administration.shtml

One of the main reasons to use NTFS is the possibility to assign permissions for individual files and folders. Each file and folder on an NTFS volume contains an Access Control List (ACL). This list is filled with entries for groups and individual user accounts and their corresponding permissions. When a user tries to access a resource, Windows XP checks the ACL if the user is listed and what level of permission is assigned.

The following permissions can be assigned for files and folders:

Read Allows user read files and list the contents of folders, subfolders and volumes, including the attributes, permissions and ownership of the files.

Write Allows the same as Read and additionally allows the user to modify and create files and (sub-)folders as well as changing attributes.

Wow, did you realize you just dug up a post from April of 2006?

Either answer is correct when taken in context. Normally, when you assign the "write" permission, that implies "read" as well, since by default read/execute, list, and read are selected - so when you also select "write", that's an additional permission. However, as _omni_ points out, you can go back and deselect everything except "write", which means you can write to a file or folder without being able to read it. This is useful in some cases like a script that logs a user's activity. However, there is no way to select "modify" and then deselect read/write/list - try and see what happens, the "modify" permission disappears if you do.

The real difference lies in the fact that "Modify" gives you everything that "Full Control" does - except for "Take Ownership" and "Change Permissions" permissions.

Hope that helps!

12mcken

sprkymrk wrote:

Wow, did you realize you just dug up a post from April of 2006?

Either answer is correct when taken in context. Normally, when you assign the "write" permission, that implies "read" as well, since by default read/execute, list, and read are selected - so when you also select "write", that's an additional permission. However, as _omni_ points out, you can go back and deselect everything except "write", which means you can write to a file or folder without being able to read it. This is useful in some cases like a script that logs a user's activity. However, there is no way to select "modify" and then deselect read/write/list - try and see what happens, the "modify" permission disappears if you do.

The real difference lies in the fact that "Modify" gives you everything that "Full Control" does - except for "Take Ownership" and "Change Permissions" permissions.

Hope that helps!

Thanks.

Since I was on the NTFS section in my studies, I thought about revisiting the Tech exam site for any tips to reinforce NTFS perm's concepts. It always helps to have additional sources.

ccnpninja

addition:
modify=read&execute + write + delete