Windows Permissions and Sharing Quiz

Chapter Objectives

• Configure File and Share Access
• Designing a File Sharing Strategy
• Creating Folder Shares
• Assigning Permissions
• Configuring NTFS Quotas

Creating Folder Shares

• Shares are required for network users to access server disks.
• To create a share, determine:
  • Folders to share
  • Names for shares
  • Permissions for users
  • Offline Files settings

Creator/Owner

• Users can share their folders.
• Right-click and select "Share with Specific People" for a simplified interface.
• Use the Sharing tab in the folder's Properties sheet for more control.

Creating Folder Shares (Dialog Box)

• The File Sharing dialog box lets you choose network users to share with.
• You can enter a user's name and click "Add" or use the arrow to find them.
• Permission levels include "Read/Write," "Owner," and "Read."

Advanced Sharing

• The Advanced Sharing dialog box provides additional settings.
• Allows specifying a share name, limit on simultaneous users, comments, permissions, and caching.

Types of Folder Shares

• Server Message Blocks (SMB): Standard file-sharing protocol used by all Windows versions. Requires the File Server role service.
• Network File System (NFS): Standard file-sharing protocol used by most UNIX and Linux distributions. Requires the Server to have the NFS role service installed.

Create a Folder Share (Homepage)

• The Shares homepage allows viewing and managing shares in Server Manager, presenting a list of all shares, associated tasks, and volumes.
• This page displays a list of shares, and enables creation of a new share using the New Share Wizard.

Select the Profile for This Share

• The New Share Wizard presents different sharing profiles:
  • SMB Share - Quick
  • SMB Share - Advanced
  • SMB Share - Applications
  • NFS Share - Quick
  • NFS Share - Advanced

Select the Server and Path for This Share

• The New Share Wizard allows choosing the server and path for the share.
• Selects which volume (e.g., C:) the new folder will be created under.
• Allows entering a custom path.

Specify Share Name

• The New Share Wizard prompts for the name and description of the share.
• It indicates whether the folder to share on the local computer exists (or will be created).
• A remote path or share can also be specified.

Configure Share Settings

• Users can decide whether to Enable access-based enumeration.
• This feature allows only files and folders with read permissions to display to users
• Allows caching of shares to make them available offline, if the BranchCache for Network Files role service is installed.
• Users can decide whether to Enable BranchCache on the share.
• Users can decide whether to Encrypt data access.

Specify Permissions to Control Access

• Permissions for files accessed via a share are decided by a combination of folder permissions, share permissions, and an optional central access policy.
• Pre-defined permissions and groups are provided (e.g., CREATOR OWNER, BUILTIN\Users).

Confirm Selections

• Before creating the share, this page confirms the settings defined in the Wizard.
• Includes information like the server, share name, protocol, disk space, and whether access-based enumeration, caching, BranchCache, and encryption are disabled.

The New Share on the Shares Homepage

• The new share appears after successful creation on the Shares homepage.

Assigning Permissions

• This section covers how to configure file and share access permissions.
• Discusses Access Control List (ACLs), Access Control Entries (ACEs), and security principals.

Windows Permissions Architecture

• ACLs (Access Control Lists) regulate access to folders.
• ACEs (Access Control Entries) determine which user has what permission by connecting to the user or group.
• Security principals are users or groups identified by Windows using security identifiers (SIDs).

The Security Tab of a Properties sheet

• Enables checking and changing permissions for different user groups, such as Everyone and Creator/Owner.

Basic and Advanced Permissions

• Basic permissions are preconfigured combinations.
• Advanced permissions offer granular controls, though rarely used.

Allowing and Denying Permissions

• Additive: Starts with no permissions, then grants Allow permissions.
• Subtractive: Grants Allow permissions, then adds Deny permissions for restricted access.

Inheriting Permissions

• Permissions apply downward to subfolders and files.

Effective Access

• The combined Allow and Deny permissions determine access to an element.
• Allow permissions are cumulative; Deny overrides Allow.
• Explicit permissions take precedence over inherited permissions.

The Effective Access Tab of the Advanced Security Settings Dialog Box

• This tab provides a detailed view of the permissions for a user, group, or device account.
• It allows evaluation of the potential impact of adding a group or user.

Setting Shared Folder Permissions

• This tab in the share's properties window allows specific share permissions.

Share Permissions

• Share permissions control access to shared folders.
• Different permissions dictate actions, such as full control, change, and read.

NTFS Authorization

• NTFS and ReFS support permissions.
• Each element has an ACL that includes ACEs (Access Control Entries) that link a security principal (person or group) with permissions.
• Security principals are identified by security identifiers (SIDs).

NTFS Basic Permissions

• Full Control: Modifying folder permissions, taking ownership, and performing related actions.
• Modify: Deleting/modifying folder(s).
• Read & Execute: Navigating and running applications within folders.
• Read: Viewing file contents, their ownership, permissions details
• Write: Creating, modifying (overwriting), attributes.

Configuring NTFS Quotas

• Enables administrators to set space restrictions for users on a volume.
• Users exceeding the limit can be either denied access or warned.

How NTFS Security and Shared Permissions Work Together

• When configuring a shared folder, both NTFS permissions (file/folder level) and shared permissions (network access) must be set up.
• When these two permissions conflict, local permissions (NTFS) take precedence.

Volume Shadow Copies

• Allows maintaining previous versions of files and folders.
• Enables reverting to earlier versions if accidentally deleted or overwritten.
• Applicable to volumes only, not individual files/folders.

NTFS Security and Shared Permissions Example

• The presentation provides an example to calculate the effective permissions for a user based on the combination of NTFS permissions and share permissions, and the hierarchy of permissions.

Volume Shadow Copies

• Allows maintaining previous versions of files on a server.
• A copy of a file is accessible even if it is deleted or overwritten.
• Can be applied to entire volumes only.

NTFS Quotas

• Enable administrators to set storage limits for users on a volume.
• Users exceeding the limit may be denied access or warned.

NTFS Basic Permissions—Additional Examples

• List Folder Contents: Viewing the names of subfolders and files within a folder.
• Read: Viewing files and subfolder contents, ownership, permissions, and attributes of a folder.
• Write: Creating new files and subfolders within a target folder, modifying folder attributes, and viewing ownership and permissions.
• Modify: Modifying file/folder attributes and deleting.
• Read & Execute: Navigating folders to access other files/folders, running applications.

Test your knowledge on Windows permissions architecture and file-sharing settings with this comprehensive quiz. Explore topics such as inheritance of permissions, NTFS permissions, and the capabilities of security principals in Windows environments.