William Stanek - Windows Server 2012 R2 Storage, Security, & Networking Pocket Consultant

with files and folders, start File Explorer.

2.Press and hold or right-click the object with which you want to work, and then tap or click Properties. In the Properties dialog box, tap or click the Security tab.

3.Tap or click Advanced to display the Advanced Security Settings dialog box.

4.On the Permissions tab, tap or click Enable Inheritance, and then tap or click OK. Note that the Enable Inheritance button is available only if permission inheritance currently is disabled.

NTFS permissions are always evaluated when a file is accessed. On NTFS and ReFS volumes, you can set security permissions on files and folders to grant or deny access to the files and folders. Because Windows Server 2012 R2 adds new layers of security, NTFS permissions now encompass the following:

■Basic permissions

■Claims-based permissions

■Special permissions

You can view NTFS permissions for files and folders by following these steps:

1.In File Explorer, press and hold or right-click the file or folder with which you want to work, and then tap or click Properties. In the Properties dialog box, tap or click the Security tab.

2.In the Group Or User Names list, select the user, computer, or group whose permissions you want to view. If the permissions are not available (dimmed), the permissions are inherited from a parent object.

Shared folders have both share permissions and NTFS permissions. You can view the underlying NTFS permissions for shared folders by following these steps:

1.In Server Manager, the Shares subnode of the File And Storage Services node shows existing shares for file servers that have been added for management.

2.Press and hold or right-click the folder with which you want to work, and then tap or click Properties to display a Properties dialog box.

3.When you tap or click Permissions in the left pane, the current share permissions and NTFS permissions are shown in the main pane.

4.To get more information, tap or click Customize Permissions to open the Advanced Security Settings dialog box.

On file servers running Windows Server 2012 R2, you can also use central access policies to precisely define the specific attributes that users and devices must have to access resources.

The basic permissions you can assign to files and folders are summarized in Table 4–2. File permissions include Full Control, Modify, Read Execute, Read, and Write. Folder permissions include Full Control, Modify, Read Execute, List Folder Contents, Read, and Write.

TABLE 4–2File and folder permissions used by Windows Server 2012 R2

Any time you work with file and folder permissions, you should keep the following in mind:

■Read is the only permission needed to run scripts. Execute permission doesn’t matter.

■Read access is required to access a shortcut and its target.

■Giving a user permission to write to a file but not to delete it doesn’t prevent the user from deleting the file’s contents.

■If a user has full control over a folder, the user can delete files in the folder regardless of the permission on the files.

The basic permissions are created by combining special permissions in logical groups. Table 4–3 shows special permissions used to create the basic permissions for files. By using advanced permission settings, you can assign these special permissions individually, if necessary. As you study the special permissions, keep the following in mind:

■By default, if no access is specifically granted or denied, the user is denied access. Further, if a permission has been explicitly denied, the deny will override any permission grant.

■Actions that users can perform are based on the sum of all the permissions assigned to the user and to all the groups of which the user is a member. For example, if the user GeorgeJ has Read access and is a member of the group Techies, which has Change access, GeorgeJ will have Change access. If Techies is a member of Administrators, which has Full Control, GeorgeJ will have complete control over the file. However, if GeorgeJ has been explicitly denied a permission, the deny will override any grant.

TABLE 4–3Special permissions for files

Table 4–4 shows special permissions used to create the basic permissions for folders. As you study the special permissions, keep in mind that when you create files and folders, these files and folders inherit certain permission settings from parent objects. These permission settings are shown as the default permissions.