IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
groups on Windows NT workstations and member servers have the right to
share directories and to manage share permissions.
The following share permissions are available under Windows NT: "No
Access", "Read", "Change" and "Full Access". The actions which the various
share permissions allow are shown in the table below:
No
access
Read
Display subdirectories and file names X
Display file contents and file
attributes
X
Run program X
Switch to a subdirectory X
Create subdirectories and add files X
Modify file attributes X
Delete subdirectories and files X
Change access rights (only relevant
for directories that are located on
NTFS data media)
Transfer ownership (only relevant for
directories that are located on NTFS
data media)
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Change Full
access
X X
X X
X X
X X
Shares can only be defined for directories, however, not for files. Share
permissions apply only to accesses made via the network, i.e. they are of no
significance to users who are allowed to work locally on the computer on
which a directory has been shared. Also, share permissions apply only in a
standardised form for all files and subdirectories in a shared directory.
Although it is also possible to share a subdirectory within a shared directory
and in so doing also to set different share permissions, this is a new share and
brings with it the following consequences: when a user is linked to the shared
directory, the share permissions specified for that directory apply to that user
with respect to all files and subdirectories. This is not changed in any way
even if a subdirectory is shared separately. If the user is linked directly to the
subdirectory, however, the share permissions set for the subdirectory apply.
Example: Let us assume the following directory structure:
D:\DEPARTMENT\SECTION. One share is set up with the DEPARTMENT
directory with "Full Access" authorisation and another share with the
SECTION subdirectory with "Read" authorisation. If the user is now
connected to the D:\DEPARTMENT directory, he can read, write to and delete
(among other things) files in that directory but also files in the
D:\DEPARTMENT\SECTION subdirectory. However, if the user sets up a
direct link to the D:\DEPARTMENT\SECTION directory, he can only read the
X
X
X
X
X