MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

8-14 Chapter 8 Securing Resources with NTFS Permissions
How to Prevent Permissions Inheritance
By default, subfolders and files inherit permissions that you assign to their parent
folder. This is indicated in the Advanced Security Settings dialog box (refer to Figure 8-
5) when the Inherit From Parent The Permission Entries That Apply To Child Objects
check box is selected. To prevent a subfolder or file from inheriting permissions from
a parent folder, clear the check box. You are then prompted to select one of the
options described in Table 8-6.
Table 8-6 Preventing Permissions Inheritance Options
Option Description
Copy Copy the permission entries that were previously applied from the parent to the
child and then deny subsequent permissions inheritance from the parent folder.
Remove Remove the permission entries that were previously applied from the parent to
the child and retain only the permissions that you explicitly assign here. Clicking
this button removes all permissions from the file or folder; if you do not grant
yourself permissions immediately afterward, you could lose access to the file. To
recover access to the file, you would need to take ownership.
Cancel Cancel the dialog box.
Guidelines for Planning NTFS Permissions
If you take the time to plan your NTFS permissions and follow a few guidelines, you
will find that permissions are more straightforward to manage than you might imagine.
Use the following guidelines when you assign NTFS permissions:
■ To simplify administration, organize files into folders so that you can assign permissions
to folders instead of directly to files.
■ Allow users only the level of access that they require. If a user only needs to read
a file, assign the Read permission to his or her user account for the file. This
reduces the possibility of users accidentally modifying or deleting important documents
and application files.
■ Create groups according to the access that the group members require for
resources, and then assign the appropriate permissions to the group. Assign permissions
to individual user accounts only when necessary.
■ When you assign permissions to application folders, assign the Read & Execute
permission to the Users group and the Administrators group. This prevents application
files from being accidentally deleted or damaged by users or viruses.
■ When you assign permissions for public data folders, assign the Read & Execute
permission and the Write permission to the Users group and the Full Control permission
to the CREATOR OWNER. By default, the user who creates a file is also