Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm somewhat confused about the whole Windows file security scheme. I come from a unix background, so I don't fully understand the relationship between file permissions/security settings and the attributes; specifically read-only, that a file can have.

For example, if I log in as an administrator into my box and I have a file that allows full control for administrators, but has the read-only attribute set, that means I cannot write to that file? Is there any way besides removing the read-only attribute that I can write to files that I supposedly have full control over? If not, what's the advantage of having full control if you don't really have full control?

share|improve this question
1  
Fantastic question –  Jim B Jun 19 '13 at 14:53
    
Windows File Attributes are analogous to Unix File Flags –  Chris S Jun 19 '13 at 15:06
    
I've edited this to be more generic, since these principles apply to all modern versions of Windows, not just Server 2003. –  MDMarra Jun 19 '13 at 15:11
    
Its actually possible to be different in 2012 and up –  Jim B Jun 20 '13 at 20:42

3 Answers 3

up vote 16 down vote accepted

File permissions dictate what access you have to a file - just like it sounds. Full control lets you create, delete, append, change permissions, change attributes, etc.

Files and folders can have additional attributes, much like files on most *nix filesystems. "Hidden" comes to mind as an example of this on both platforms.

On Windows, some of the additional attributes include system, read-only, archive, encrypted, and compressed. When you have full control (or modify) you have the ability to change these attributes, but as you've discovered, a read-only file is read-only, even to someone with full control. While full control gives you the ability to change a file's attributes, it does not automatically override them, much like ls doesn't show the root user a hidden file by default on *nix.

share|improve this answer
    
There is no such thing as a "hidden" NTFS file using an attribute. Files can be hidden using streams. NTFS supports any attributes required by any application using the extended attributes field ($EA) which is why you can store unix file permissions in an NTFS filesystem –  Jim B Jun 19 '13 at 16:09
6  
I didn't say that "hidden" is a function of NTFS anywhere, but "hidden" is most certainly an attribute that you can set on a file or folder. I really have no idea what the point that you're trying to make is. –  MDMarra Jun 19 '13 at 16:15
    
What's this hidden attribute on Unix? –  Edward Thomson Jun 19 '13 at 19:17
    
Hidden was possibly a poor example but illustrated my point. There isn't a "hidden" attribute per se, just files that are prefixed with a period. The windows file attributes in question are actually more closely analogous to something like file flags in unix: freebsd.org/cgi/man.cgi?query=chflags&sektion=1. –  MDMarra Jun 19 '13 at 19:37

A permission is a security control. An attribute applies regardless of the security principal attempting the operation.

There are far more attributes than what you see at the command prompt. These include if the file is a link, encrypted, directory (a type of file), and integrity (low, medium, or high).

File Attribute Constants
http://msdn.microsoft.com/en-us/library/windows/desktop/gg258117%28v=vs.85%29.aspx

FILE_ATTRIBUTE_ARCHIVE 32 (0x20)

A file or directory that is an archive file or directory. Applications typically use this attribute to mark files for backup or removal .

FILE_ATTRIBUTE_COMPRESSED 2048 (0x800)

A file or directory that is compressed. For a file, all of the data in the file is compressed. For a directory, compression is the default for newly created files and subdirectories.

FILE_ATTRIBUTE_DEVICE 64 (0x40)

This value is reserved for system use.

FILE_ATTRIBUTE_DIRECTORY 16 (0x10)

The handle that identifies a directory.

FILE_ATTRIBUTE_ENCRYPTED 16384 (0x4000)

A file or directory that is encrypted. For a file, all data streams in the file are encrypted. For a directory, encryption is the default for newly created files and subdirectories.

FILE_ATTRIBUTE_HIDDEN 2 (0x2) The file or directory is hidden. It is not included in an ordinary directory listing.

FILE_ATTRIBUTE_INTEGRITY_STREAM 32768 (0x8000)

The directory or user data stream is configured with integrity (only supported on ReFS volumes). It is not included in an ordinary directory listing. The integrity setting persists with the file if it's renamed. If a file is copied the destination file will have integrity set if either the source file or destination directory have integrity set.

Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP: This flag is not supported until Windows Server 2012.

FILE_ATTRIBUTE_NORMAL 128 (0x80)

A file that does not have other attributes set. This attribute is valid only when used alone.

FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 8192 (0x2000)

The file or directory is not to be indexed by the content indexing service.

FILE_ATTRIBUTE_NO_SCRUB_DATA 131072 (0x20000)

The user data stream not to be read by the background data integrity scanner (AKA scrubber). When set on a directory it only provides inheritance. This flag is only supported on Storage Spaces and ReFS volumes. It is not included in an ordinary directory listing.

Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP: This flag is not supported until Windows 8 and Windows Server 2012.

FILE_ATTRIBUTE_OFFLINE 4096 (0x1000)

The data of a file is not available immediately. This attribute indicates that the file data is physically moved to offline storage. This attribute is used by Remote Storage, which is the hierarchical storage management software. Applications should not arbitrarily change this attribute.

FILE_ATTRIBUTE_READONLY 1 (0x1)

A file that is read-only. Applications can read the file, but cannot write to it or delete it. This attribute is not honored on directories. For more information, see You cannot view or change the Read-only or the System attributes of folders in Windows Server 2003, in Windows XP, in Windows Vista or in Windows 7.

FILE_ATTRIBUTE_REPARSE_POINT 1024 (0x400)

A file or directory that has an associated reparse point, or a file that is a symbolic link.

FILE_ATTRIBUTE_SPARSE_FILE 512 (0x200)

A file that is a sparse file.

FILE_ATTRIBUTE_SYSTEM 4 (0x4)

A file or directory that the operating system uses a part of, or uses exclusively.

FILE_ATTRIBUTE_TEMPORARY 256 (0x100)

A file that is being used for temporary storage. File systems avoid writing data back to mass storage if sufficient cache memory is available, because typically, an application deletes a temporary file after the handle is closed. In that scenario, the system can entirely avoid writing the data. Otherwise, the data is written after the handle is closed.

FILE_ATTRIBUTE_VIRTUAL 65536 (0x10000)

This value is reserved for system use.

share|improve this answer
    
This doesn't exactly answer the question. They were wondering why read-only was superceding the "full control" privilege. These attributes are used within programs. –  Nathan C Jun 19 '13 at 16:26
1  
You've also mixed FAT-Style and NTFS Attributes - not that's there's a large difference anymore, but there are times when it's critical to differentiate. –  Chris S Jun 19 '13 at 16:46
    
@Nathan C. This also exactly answers the question. Read-only doesn't supercede full control. As the answer says "An attribute applies regardless of the security principal attempting the operation. " However as Chris S pointed out, the optional legacy attributes are mixed with the NTFS attributes. –  Jim B Jul 16 '13 at 1:05

I'll provide a longer answer but in general the attributes you are referring to are legacy settings on a file from the days of DOS FAT filesystem. FAT stores these atributes as a part of teh filesystem directory entries for a file. NTFS has it's own set of attributes that encapsulate the older attributes. By default any user with file access can modify them and can be used to prevent accidental overwrites of data.

Permissions are NTFS specific and changes to those permissions can be controlled on a per user basis (so that a user cannot change from read only to writable). Specifically if you were to look at the attrib command (which shows both legacy and the new attribute additions like integrity in later versions of windows) it's possible to have read only access set in permissions but not have read only set in the attributes. It's also interesting (if not important) to understand that due to the abstraction its technically possible to enable the legacy attributes (stored in the $standard_information NTFS attribute) without them necessarily showing in the normal GUI.

Specifically the full control permissions allows you to change any NTFS permissions. Setting the read only attribute prevents changes until it's removed.

FAT attributes will take precedence over NTFS attributes under windows.

share|improve this answer
3  
in general attributes are legacy settings - Do you have a source for this, because I believe that statement to be incorrect. They're complimentary to filesystem permissions - they haven't been replaced or superseded by them. There's nothing in standard permissions that replaces the functionality of hidden, archive, or system. –  MDMarra Jun 19 '13 at 15:01
1  
Any user can modify them and can be used to prevent accidental overwrites of data. Also, this is factually incorrect. Only users with "write attribute" to a file or directory can change the attributes on that object. –  MDMarra Jun 19 '13 at 15:06
1  
i.stack.imgur.com/2fhEr.png for clarification. –  Nathan C Jun 19 '13 at 16:21
2  
Jim, please take a minute to look at this from the beginning. You've gone so far down this "NTFS attribute" rabbit hole that you've forgotten that you're the only one talking about NTFS attributes. The OP clearly is talking about global file attributes like "Hidden" and "Read Only." He explicitly mentions "Read only" in the question. I can't tell if you're trying to be pedantic and failing or if you're legitimately missed this point. Yes, we know, NTFS (extended) attributes are not the same as global (FAT-style) file/folder attributes. No one is claiming that. –  MDMarra Jun 19 '13 at 16:30
3  
I think you've clearly missed the spirit and intent of this question and you're trying to take a stance that is one part incorrect and one part unhelpful. You've clearly shown that you have a grasp of how NTFS attributes work, however no one was asking about them and no one used them in an answer in the first place. If you were trying to show off your knowledge of NTFS attributes, you've done well. The problem is that you've completely missed the point of the question. –  MDMarra Jun 19 '13 at 16:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.