MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

8-4 Chapter 8 Securing Resources with NTFS Permissions
!
What Are Effective Permissions?
A user’s effective permissions for a resource are the sum of the NTFS permissions
that you assign to the individual user account and to all the groups to which the user
belongs. If a user is granted Read permission for a folder and is a member of a group
with Write permission for the same folder, the user has both Read and Write permissions
for that folder.
Exam Tip To manually calculate effective NTFS permissions, first combine all allow permissions
from all sources. Next, determine any deny permissions the user has. Deny permissions
override allow permissions. The result is the user’s effective permissions for the
resource.
How File Permissions Override Folder Permissions
NTFS permissions assigned to files take priority over NTFS permissions assigned to the
folder that contains the file. If you have access to a file, you can access the file if you
have the Bypass Traverse Checking security permission—even if you do not have
access to the folder containing the file. You can access the files for which you have permissions
by using the full Universal Naming Convention (UNC) or local path to open
the file from its respective application, even if you have no permission to access the
folder that contains the file. In other words, if you do not have permission to access the
folder containing the file you want to access, you must have the Bypass Traverse
Checking security permission and you have to know the full path to the file to access
it. Without permission to access the folder, you cannot see the folder, so you cannot
browse for the file.
See Also The Bypass Traverse Checking security permission is described further in Lesson 2,
“Assigning NTFS Permissions and Special Permissions.”
How Deny Permissions Override Allow Permissions
In addition to granting a permission, you can also specifically deny a permission
(although this is not the recommended method of controlling access to resources).
Denying a permission overrides all instances in which that permission is allowed. Even
if a user has permission to access a file or folder as a member of a group, denying permission
to the user blocks any other permissions the user might have (see Figure 8-1).
In Figure 8-1, User1 has Read permission for FolderA and is a member of Group A and
Group B. Group B has Write permission for FolderA. Group A has been denied Write
permission for File2.