I just realized there's a difference between these two after I had to change a privilege to change permissions on a folder (and then set them back again).
P.S. If this is a stupid question, I apologize I'm still figuring alot of these things out.
-
1I found this list of privilege constants: msdn.microsoft.com/en-us/library/windows/desktop/…– leeand00Aug 18, 2016 at 17:54
Add a comment
|
3 Answers
Concerning Active Directory, a privilege is "what you can do" such as impersonate a client after authentication or concerning Windows itself Change the system time.
A permission is an access control applied to objects such as the file system, registry, and Active Directory objects like groups and users. The Access Control Lists grant users and/or groups the ability perform various operations on the object. For example, an object such as a Folder has an Access Control List for users to Read the contents of the folder, but not to Edit or Delete.
To show the difference between the two: A Folder may have the permission denying Admins Read and Write access to the folder, leaving Admins unable to access the Folder. However, since Admins have the user right (privilege) Take ownership of files or other objects, the Admin can simply take ownership of the Folder, then change the Folder's ACL to give Administrators Read and Write permissions of the Folder.
answered Aug 18, 2016 at 18:21
-
When you say Admins, do you mean (domain admins xor local admins) or both?– leeand00Aug 18, 2016 at 18:56
-
1Both. My example was, in my mind, on a local machine, but yeah both. Local Admins' scope of privilege is locally - restricted to the computer, while domain admins' scope of privilege is the domain. Aug 18, 2016 at 19:05
A privilege (or user right) governs what you can do (logon interactively, logon remotely, etc.).
A permission governs what you can access (files, folders, objects, etc.).
answered Aug 18, 2016 at 18:29
These are the privileges. You already know what permissions are.
If you think about it , there isn't a distinct line between them tho. "Allow log on locally" is a privilege , but, when you add a user there, you're just giving them permission to log on to that computer. Again, you can say that permissions are given on resources, but, "computer" is also a resource in my example above.
Instead of trying to understand what they are called, you should learn the list of privileges from the web page I linked above. That is the whole list and that will help you solve your problems.
