William Stanek - Windows Server 2012 R2 Storage, Security, & Networking Pocket Consultant

TABLE 4–4Special permissions for folders

To set basic NTFS permissions for files and folders, follow these steps:

1.In File Explorer, press and hold or right-click the file or folder with which you want to work, and then tap or click Properties. In the Properties dialog box, tap or click the Security tab.

2.Tap or click Edit to display an editable version of the Security tab, as shown in Figure 4–1.

FIGURE 4–1Configure basic permissions for the file or folder on the Security tab.

3.Users or groups that already have access to the file or folder are listed in the Group Or User Names list. You can change permissions for these users and groups by doing the following:

a.Select the user or group you want to change.

b.Grant or deny access permissions in the Permissions box.

TIP Inherited permissions are shaded (dimmed). If you want to override an inherited permission, select the opposite permission.

4.To set access permissions for additional users, computers, or groups, tap or click Add to display the Select Users, Computers, Service Accounts, Or Groups dialog box.

5.Enter the name of a user, computer, or group in the current domain, and then tap or click Check Names. One of the following actions occurs:

■If a single match is found, the dialog box is updated and the entry is underlined.

■If no matches are found, you entered an incorrect name part or are working with an incorrect location. Modify the name and try again, or tap or click Locations to select a new location.

■If multiple matches are found, select the name or names you want to use, and then tap or click OK. To add more users, computers, or groups, enter a semicolon (;), and then repeat this step.

NOTE The Locations button allows you to access account names in other domains. Tap or click Locations to view a list of the current domain, trusted domains, and other resources you can access. Because of the transitive trusts in Windows Server 2012 R2, you can usually access all the domains in the domain tree or forest.

6.In the Group Or User Names list, select the user, computer, or group you want to configure, and in the check boxes in the Permissions list, allow or deny permissions. Repeat for other users, computers, or groups.

7.Tap or click OK.

Because shared folders also have NTFS permissions, you might want to set basic NTFS permissions by using Server Manager. To do this, follow these steps:

1.In Server Manager, select File and Storage Services, select the server with which you want to work, and then Select Shares.

2.Press and hold or right-click the folder with which you want to work, and then tap or click Properties to display a Properties dialog box.

3.When you tap or click Permissions in the left pane, the current share permissions and NTFS permissions are shown in the main pane.

4.Tap or click Customize Permissions to open the Advanced Security Settings dialog box with the Permissions tab selected.

5.Users or groups that already have access to the file or folder are listed under Permission Entries. Use the options provided to view, edit, add, or remove permissions for users and groups.

To set special NTFS permissions for files and folders, follow these steps:

1.In File Explorer, press and hold or right-click the file or folder with which you

want to work, and then tap or click Properties.

2.In the Properties dialog box, select the Security tab, and then tap or click Advanced to display the Advanced Security Settings dialog box. Before you can modify permissions, you must click Change Permissions. As shown in Figure 4–2, the permissions are presented much as they are on the Security tab. The key differences are that you see individual allow or deny permission sets, whether permissions are inherited and where they are from, and the resources to which the permissions apply.

FIGURE 4–2Configure special permissions on files and folders.

3.If a user or group already has permissions set for the file or folder (and those permissions are not being inherited), you can modify the special permissions by selecting the user or group, and then clicking Edit. Afterward, skip steps 4–7, and then follow the rest of the steps in this procedure.

4.To add special permissions for a user or group, tap or click Add to display the Permission Entry dialog box. Tap or click Select A Principal to display the Select User, Computer, Service Account, Or Group dialog box.

5.Enter the name of a user or a group account. Be sure to reference the user account name rather than the user’s full name. Only one name can be entered at a time.

6.Tap or click Check Names. If a single match is found for each entry, the dialog box is automatically updated and the entry is underlined; otherwise, you’ll get an additional dialog box. If no matches are found, you either entered the name incorrectly, or you’re working with an incorrect location. Modify the name in the Name Not Found dialog box and try again, or tap or click Locations to select a new location. When multiple matches are found, in the Multiple Names Found dialog box, select the name you want to use, and then tap or click OK.

7.Tap or click OK. The user and group are added as the Principal, and the Permission Entry dialog box is updated to show this.