1. The document discusses security permissions for file sharing and accessing resources on a network, including share-level permissions, NTFS permissions, and group policies. 2. Share-level permissions allow control over reading, changing, and full control access when folders are shared on the network, while NTFS permissions provide more granular control over individual files and folders. 3. Effective permissions are determined by evaluating all group memberships a user has, and the most restrictive permission is applied. Group policies can also be used to configure security settings across an organization.

1. SECURITY AND SECURITY PERMISSIONS Chapter 9

2. CHAPTER OVERVIEW AND OBJECTIVES Simple File Sharing Share-level permissions NTFS permissions Combined permissions Security and group policies

3. SIMPLE FILE SHARING

4. RUNNING THE NETWORK SETUP WIZARD

5. SHARING A FOLDER ON THE NETWORK

6. ENABLING SHARE-LEVEL PERMISSIONS

7. SHARE-LEVEL PERMISSIONS Read Allows users to view files and folders, view the contents of files and subfolders, and execute programs.* Change Full Control Share Permission Description Allows the user to change NTFS permissions on files and folders (including the shared folder). Administrators must configure share permissions locally or using the Computer Management console. Allows users to add and remove files and subfolders and edit files. *Programs requiring the ability to write to configuration files will not run properly without the Change permission.

8. SETTING SHARE-LEVEL PERMISSIONS

9. CALCULATING EFFECTIVE PERMISSIONS Evaluate all group memberships Effective permission is the least restrictive

10. TROUBLESHOOTING SHARE-LEVEL PERMISSIONS Evaluate all group memberships Ensure permissions are appropriate to requirements Consider Deny permissions

11. NTFS PERMISSIONS

12. STANDARD NTFS PERMISSIONS Read Open files and subfolders Open files List Folder Contents Read and Execute Write Modify Full Control NTFS Permission Folders Files Not applicable List contents of folder, traverse folder to open subfolders Create subfolders and add files Not applicable Open files, execute programs All the above + delete All the above + change permissions and take ownership, delete subfolders All the above Modify files All the above + change permissions and take ownership

13. EFFECTIVE NTFS PERMISSIONS Evaluate all group memberships Effective permission is the least restrictive Deny overrides all others

14. TROUBLESHOOTING NTFS PERMISSIONS Evaluate all group memberships Ensure permissions are appropriate to requirements Consider Deny permissions

15. COMBINING SHARE-LEVEL AND NTFS PERMISSIONS

16. DISCUSSION SCENARIO Finance Bob W., Renee K., Jason G. Manufacturing Ron C., Jerome J. Managers Ron C., Renee K. Reports Finance (Change) Finance (Full Control) Manufacturing (Full Control) Manufacturing (Read + Write) Managers (Read) Managers (Read) Graphics Managers (Change) Managers (Modify) Manufacturing (Deny Read) Group Users in Group Folder Share Permissions NTFS Permissions

17. BUILT-IN GROUPS Administrators Power Users Backup Operators Users

18. CHANGING USER GROUP MEMBERSHIPS User gets access token at logon based on group membership Group membership is changed User needs to log on again to receive new access token

19. LOCAL SECURITY SETTINGS

20. ACCOUNT POLICIES

21. ACCOUNT POLICIES (CONT.)

22. LOCAL POLICIES

23. GROUP POLICIES

24. CONFIGURING GROUP POLICY SETTINGS

25. TROUBLESHOOTING GROUP POLICIES Help and Support Gpresult.exe Rsoc.exe

26. SUMMARY Simple File Sharing is used in small and home offices No permission restriction for locally shared files Network shared files can be marked read-only Standard share-level permissions are used in larger organizations Ability to control access to Read, Change, Full Control Effective permission is the least restrictive

27. SUMMARY (CONT.) NTFS permissions Incorporated into the file system More granular than share-level permissions Effective permission is the least restrictive Combined permissions The more restrictive of either share-level or NTFS

28. SUMMARY (CONT.) Local security policy Controls password strength Controls account lockout policy Assigns user rights and other security-related settings Group policy Controls desktop and application configuration Is tiered so site, domain, and organizational unit override local settings