Windows sysinternals

340 Part II Usage Guide
Volume Permissions
Several of the utilities in this chapter depend on the permissions on the target volume.
For example, the command sync e requires that the caller have Write permissions on
the E drive. Volume permissions are distinct from those on the volume’s root directory,
and these permissions can apply restrictions even on volumes with file systems such as
FAT that do not support access control.
Write permissions are granted only to administrators for all volumes on Windows
XP and all versions of Windows Server. Beginning with Windows Vista, interactively
logged-on users are granted Write permissions for removable volumes such as flash
drives.
Windows does not provide any utilities that show the permissions on volume objects.
You can use AccessChk for this purpose, using the syntax accesschk \\.\x:, where x is
the drive letter of the volume you want to inspect. See Chapter 8, “Security Utilities,” for
more information about AccessChk.
FIGURE 12-5 The effects of volume permissions.
Figure 12-5 shows Sync attempting to flush the disk caches for C and E while running
as a standard user on Windows 7. Sync, which requires Write permissions, fails for C but
succeeds for E. The example then shows AccessChk displaying the effective permissions
for the two volumes. On C, standard users have only the Read permissions granted to
Everyone, but on E interactive users (NT AUTHORITY\INTERACTIVE) are granted Read
and Write permissions.
www.it-ebooks.info