MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

Page
8-32
Page
8-33
8-43
4. If you do not want a user or group to gain access to a particular folder or file,
should you deny access permissions to that folder or file?
You should assign permissions to the folder or file rather than deny permission to access the
folder or file. Denying permissions should be an exception, not common practice.
Case Scenario Exercise
1. Will users in the Part Time And Contractors group be able to open the files protected
by the confidentiality agreement?
No. The Deny Full Control permission will prevent users from being able to access the file.
2. Even if users of the Part Time And Contractors groups cannot access the file, there
is a risk that they will delete the file. Why?
Full Control includes the Delete Subfolders And Files special permission for POSIX compliance.
This special permission allows a user to delete files in the root of a folder to which the user has
been assigned Full Control permission. This permission overrides the file permissions.
3. How could you solve this problem by changing permissions on the Client
Accounts folder?
Allow users all of the individual permissions, and then deny users the Delete Subfolders And
Files special permission.
4. What would have been a better way to approach this problem from the beginning?
It is better to not use Deny permissions unless absolutely necessary. The simplest and most
secure way to approach this problem would be to put the files that are protected by a confidentiality
agreement into a separate folder from the Client Accounts folder. You could then grant
permissions on the separate folder only to users that need permissions.
Troubleshooting Lab
Questions and Answers
1. Based on the information in tables that your boss gave you, what are David’s
effective permissions on the Brochures folder?
To determine David’s effective permissions, you must combine all the permissions that have
been assigned. Thus, David’s effective permissions on the Brochures folder are Read & Execute,
List Folder Contents, and Read.
2. Your boss stops by and says, “Whoops, here is the other table I meant to give
you.” The table shows the permissions assigned to the Accounting group for the
Brochures folder. A user named Yvette is a member the Sales, Marketing, and
Accounting groups.