IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.53 Restrictive allocation of access rights to files
and directories underWindows NT
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Under Windows NT, a distinction is made between access rights at the share
level, and access rights at the file and directory level, termed NTFS rights in
the following. Access rights at the share level are described in S 2.94 Sharing
of directories under Windows NT.
As opposed to share rights, access rights at the file and directory level are only
available on data media with the NTFS file system. As a rule, these rights are
assigned by the creator or owner of an object (directory or file). On servers,
this is usually done by the administrator. Under Windows NT 4.0, NTFS
permissions are granted typically using the Windows NT Explorer or "My
Computer" desktop symbol. The menu item designated "Attributes / Security"
is to be selected in the context menu of the related directory or file. The
following access control list is then invoked:
Under Windows NT 3.51, the access control list is to be found under "Security
/ Authorisations" in the File Manager. Existing user groups and users can be
added to this list; furthermore, rights can be granted to, and withdrawn from,
every user group and user here. It is also possible to remove user groups and
users from the access control list. By activating the option labelled "Replace
permissions on existing files", the rights specified for the directory can be
transferred to all the files located therein. If the option labelled "Replace
permissions on subdirectories" is selected, the specified rights are also
transferred to all subdirectories. This allows easy realisation of standard
permission profiles.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000