What are NTFS permissions and how to manage them correctly in Windows?

In the day-to-day administration of Windows systems, one of the most critical aspects is controlling access to files and folders. If you've ever wondered why you sometimes can't delete a folder, change a file, or even access your own information, you're probably wondering why NTFS permissions have the answer. Understanding how they work and how they're managed is not only useful, but essential if you want to keep your system safe and tidy.

In this article, I'm going to explain it to you once and for all. What are NTFS permissions?, what they're used for, how they're inherited, and how you can manage them properly to avoid classic access problems and, at the same time, protect your data from prying eyes. If you have a server or just a personal computer and value your privacy and that of your users, don't miss out!

What is NTFS and why is it so popular?

NTFS means New Technology File System. It's the recommended and most widely used file system in Windows operating systems since the 90s, both in desktop and server versions. Why has it survived so long? Because it's a very advanced, secure, and flexible system. It allows you to manage large volumes of data, offers reliability (with its transaction log or journaling), self-healing from errors, support for long names and paths, generation of quotas per user, and, above all, a powerful management scheme. granular security and permissions.

NTFS is found in all current versions of Windows: Windows 11, Windows 10, Windows Server 2022, 2019, 2016, and earlier systems since Windows NT 3.1. Its features have evolved, but permissions management has always been one of its pillars. NTFS's success is due to the fact that it provides complete control over who can access, modify, execute, or delete any file or folder, all in a hierarchical and easily manageable manner.

What exactly are NTFS permissions?

In each file or folder managed by NTFS, there is an associated access control list (ACL, Access Control List). This list indicates which users or groups can do what with the resource. There are two main types of ACLs:

• DACL (Discretionary ACL): Decide which actions are allowed or prohibited.
• SACL (System ACL): Determines which actions should be audited or logged for security monitoring.

On NTFS permissions They can be granted at the file or folder level and can be assigned to individual users or groups. Furthermore, the NTFS permission structure is cumulative: if a user belongs to multiple groups, their permissions are added together, unless explicitly denied, which always prevails.

Standard NTFS Permission Types

In the NTFS system, there are standard permissions, which are the basic building blocks for defining access. These are:

• Full Control: The user can perform any action, from reading to changing permissions, deleting or adding files and folders.
• Modify: Allows you to change the contents of files and folders, as well as delete them.
• Reading and execution: Provides the ability to read and execute files, including programs.
• List the contents of the folder: Allows you to view the files and subfolders in a folder (for folders only).
• Reading: Gives access to view the contents of files and folders, including attributes and permissions.
• Writing Instruments: Allows you to create files/folders and modify existing ones.

In addition, there are special permits which can be assigned to grant or deny very specific actions. These are often used when much more detailed control is required.

NTFS Special Permissions and What They Mean

For those who want to be more specific, NTFS allows the use of special permissions. Here are the most important ones and what they allow:

• Browse folder / Run file: Enter folders or run a program, respectively.
• List folder / Read data: View files inside a folder or read the contents of a file.
• Reading attributes and extended attributes: View extra information about files and folders.
• Create files / Write data: Add files or modify existing data.
• Create folders / Add data: Create new subfolders or add data to the end of a file.
• Writing attributes and extended attributes: Modify additional information about files and folders.
• Delete subfolders and files: Delete everything inside a folder, even if you don't have explicit permission to delete it individually.
• Delete: Delete a specific file or folder.
• View permissions: Read what permissions are configured.
• Change permissions: Modify existing permissions.
• Take ownership: Assign yourself as the owner to modify permissions.
• Synchronize: Allows waiting and coordination between processes.

These permissions are combined according to what you want to allow or restrict. For example, in a shared folder for documents, you can allow everyone to view files, but only certain users can modify or delete them.

Explicit Permissions and Inherited Permissions: Inheritance in NTFS

One of the key concepts in NTFS is the inheritance of permissionsWhen you assign permissions to a folder (the "parent"), those permissions are usually automatically transferred to the subfolders and files it contains (the "children"). This way, you only need to define permissions once at the top of the hierarchy, and everything below it will inherit them.

But you can also assign explicit permissions to a specific subfolder or file, breaking inheritance. This way, you can, for example, deny access to a specific file even if the rest of the folder is visible to a group of users.

It's not necessary to break inheritance for no reason. Changing it often complicates administration. The key is to understand when it's best to maintain inheritance and when it's better to customize permissions at certain levels.

How to modify and manage NTFS permissions in Windows?

Permission management is usually done from the Windows Explorer:

1. Right-click on the desired file or folder and choose “Properties.”
2. Go to the Security tab to see the users and groups with assigned permissions.
3. If you want to change them, click "Edit" and modify the permissions as needed.
4. To add users or groups, use “Add” and then select the appropriate permission level.
5. Click “Apply” and “OK” to save changes.

From here you can also manage inheritance by accessing "Advanced Options" and choosing whether or not you want an element to inherit permissions from its parent.

What happens to permissions when copying or moving files and folders?

Something very important: Permissions may change when you copy or move files and foldersIf you move a file within the same NTFS volume, it retains its permissions. But if you copy it to another volume, it will assume the destination folder's (inherited) permissions. This can cause surprises and leave files more exposed or locked, so be careful when reorganizing your folder structure.

NTFS Permissions vs. Share Permissions

In Windows there are two main types of permissions for network shared files: NTFS and those of Share. NTFS controls local and remote access, while Sharing only affects network access and can be applied even to FAT/FAT32 systems. By default, the most restrictive permit prevailsIf NTFS allows modifying but the Share permission only allows reading, the user will only be able to read even if accessed from the network.

In practice, if you need fine-grained control, it's always best to use NTFS. Share permissions are basic and geared more toward simple network user situations.

How to Check and Change NTFS and Share Permissions

Do you want to know who has access to a folder or change it?

• For NTFS: Right click → Properties → Security (view and edit).
• To Share: Right click → Properties → Sharing → Advanced Sharing → Permissions (view and edit).

Remember to add the appropriate users or groups and assign them specific permissions. Pay attention to inheritance: you can decide at what level changes are applied.

Special considerations and common problems

• The administrator account is usually disabled by default. Remember to enable it and assign a password if you're going to use it to manage permissions.
• The user setting permissions must have the "change permissions" permission to operate correctly.
• Poorly managed inheritance can lead to unauthorized access or blockages. Consider carefully whether you should keep it or leave everything explicit.
• If you have to restore the original permissions of an NTFS folder or volume, in the official Microsoft documentation you will find procedures and scripts to do so.

NTFS Permissions in Server Environments and Practical Examples

On Windows servers, especially for web hosting or file sharing, it's common to need to assign very specific permissions. Some common examples include:

• The shared root folder is usually restricted to administrators and system services.
• Each site or user has a folder assigned to them where they can only read the content, but not modify it unless they are the owner.
• Log folders should be kept out of public access and only accessible by the system or the administrator.

Therefore, proper planning of the structure and assignment of permissions is essential for the security and proper functioning of the platform.

Advanced Management: Disable inheritance on system directories and registry permissions

In advanced security scenarios, you can disable inheritance on critical system folders (e.g., System32) to prevent accidental permissions from spreading. Additionally, permissions can be granted on key parts of the Windows' register, restricting modification or reading to administrators and the system only.

These steps are delicate, and any errors can render the system inaccessible, so please review the documentation and make backup copies before touching any system directories or keys.

NTFS disk quotas and BitLocker protection

NTFS also allows you to define space quotas to restrict the amount of data each user or group can store. If a user exceeds the defined quota, the system can issue warnings or prevent writing altogether. This control is very useful in multi-user or shared storage environments.

Additional protection with BitLocker It allows you to encrypt entire volumes, preventing unauthorized access even if the disk is physically removed. Activating it is simple from the disk properties, and its use is almost transparent to the user.

Limitations and final considerations

On NTFS permissions only work on disks and partitions formatted with NTFSIf you're working with FAT32, you won't be able to set these advanced controls. To migrate from FAT32 to NTFS, you can use tools like "convert" from the command line or graphical partition managers.

Keep in mind that managing NTFS permissions, while not overly complex, requires careful attention to prevent unwanted access or lockouts. Regular review, documentation, and good administration practices are the best safeguards.

It is essential to understand and handle correctly the NTFS permissions to ensure security and efficiency in file management. A well-configured system not only protects data, but also facilitates administration and prevents accidental errors that could compromise system integrity. Share the information so that other users know about the topic.