MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

8-12 Chapter 8 Securing Resources with NTFS Permissions
!
Table 8-5 Special Permissions
Permission Description
Create Folders/
Append Data
Create Folders allows or denies the creation of folders within the folder.
Create Folders applies only to folders.
Append Data allows or denies making changes to the end of the file, but
not changing, deleting, or overwriting existing data. Append Data applies to
files only.
Write Attributes Write Attributes allows or denies the changing of the attributes of a file or
folder. These attributes are defined by NTFS.
Write Extended
Attributes
Delete Subfolders
And Files
Write Extended Attributes allows or denies the changing of the extended
attributes of a file or a folder. These attributes are defined by programs.
Delete Subfolders And Files allows or denies the deletion of subfolders or
files within a folder, even if the Delete permission has not been granted on
the particular subfolder or file.
Delete Delete allows or denies the deletion of a file or folder. A user can delete a
file or folder even without having the Delete permission granted on that file
or folder, if the Delete Subfolder And Files permission has been granted to
the user on the parent folder.
Read Permissions Read Permissions allows or denies the reading of the permissions assigned
to the file or folder.
Change Permissions
Change Permissions allows or denies the changing of the permissions
assigned to the file or folder. You can give other administrators and users
the ability to change permissions for a file or folder without giving them the
Full Control permission over the file or folder. In this way, the administrator
or user cannot delete or write to the file or folder, but can assign permissions
to the file or folder.
Take Ownership Take Ownership allows or denies taking ownership of the file or folder. The
owner of a file can always change permissions on a file or folder, regardless
of the permissions set to protect the file or folder.
Synchronize Synchronize allows or denies different threads in a multithreaded program
to synchronize with one another. A multithreaded program performs multiple
actions simultaneously by using both processors in a dual-processor
computer. This permission is not assigned to users, but instead applies only
to multithreaded programs.
Exam Tip When you grant permissions, grant users the minimum permissions that they
need to get their job done. This is referred to as the principle of least privilege.