Security

You can assign permissions to files or folders and determine what can be done to those resources. Note that you cannot assign rights to files or folders.

For information about how to set file or folder permissions, see Windows 2000 Professional Help.

To Set File or Folder Permissions

1. Open Windows Explorer, and then locate the file or folder for which you want to set permissions.

2. Right-click the file or folder, click Properties , and then click the Security tab.

3. To set up permissions for a new group or user, click Add . Type the name of the group or user you want to set permissions for using the format domainname\name , and then click OK to close the dialog box.
   – Or –
   To change or remove permissions from an existing group or user, click the name of the group or user.

4. In Permissions , click Allow or Deny for each permission you want to allow or deny.
   – Or –
   To remove the group or user from the permissions list, click Remove .

After you set permissions on a folder, new files and subfolders created in the folder inherit these permissions unless you configure this not to happen.

To Prevent A Folder from Imposing Permissions on New Files or Folders

1. In My Computer, right-click the folder in question, and then click Properties .

2. On the Security tab, click Advanced .

3. Select a permission entry from the Permissions Entries list, and then click View/Edit .

4. Select an alternate inheritance behavior from the Apply onto drop-down list.

To Prevent New Files or Folders from Inheriting Permissions

1. Using My Computer , right-click the folder in question, and then click Properties .

2. On the Security tab, clear the Allow inheritable permissions from parent to propagate to this object check box.

If the check boxes appear shaded, the file or folder has inherited permissions from the parent folder. There are three ways to make changes to inherited permissions:

• Make the changes to the parent folder, and then the file or folder will inherit these permissions.

• Select the opposite permission ( Allow or Deny ) to override the inherited permission.

• Clear the Allow inheritable permissions from parent to propagate to this object check box. Now you can make changes to the permissions or remove the user or group from the permissions list. However, the file or folder will no longer inherit permissions from the parent folder.

If neither Allow nor Deny is selected for a permission, then the group or user might have obtained the permission through group membership. If the group or user has not obtained the permission through membership in another group, the group or user is implicitly denied the permission. To explicitly allow or deny the permission, click the appropriate check box.

The following section describes the default permissions provided to different users.

Table 13.6 describes the default file system and registry permissions.

Table 13.6 Default Settings for User Write Access

Table 13.7 describes the default access control settings that are applied to file system objects for Power Users and Users during a clean installation of the Windows 2000 operating system onto an NTFS partition. For directories, unless otherwise stated (in parentheses), the permissions apply to the directory, subdirectories, and files.

• %systemdir% refers to %windir%\system32.

• *.* refers to the files (not directories) contained in a directory.

• RX means Read and Execute.

Table 13.7 Default Access Control Settings for File System Objects

Note that a Power User can write new files into the following directories but cannot modify the files that are installed there during text-mode setup. Furthermore, all other Power Users inherit Modify permissions on files created in these directories.

• %windir%

• %windir%\config

• %windir%\cursors

• %windir%\fonts

• %windir%\help

• %windir%\inf

• %windir%\media

• %windir%\system

• %systemdir%

• %systemdir%\OS2

• %systemdir%\OS2\DLL

• %systemdir%\RAS

• %systemdir%\Viewers

For directories designated as [Modify (Dir\Subdirs) RX (Files)], Power Users can write new files; however, other Power Users will only have read access to those files.

Table 13.8 describes the default access control settings that are applied to registry objects for Power Users and Users during a clean installation of the Windows 2000 operating system. For a given object, permissions apply to that object and all child objects unless the child object is also listed in the table.

Table 13.8 Registry Permissions for Power Users and Users

For more information, see the Distributed Systems Guide in the Windows 2000 Server Resource Kit .