According to the article: http://ntfs.com/ntfs-permissions-precedence.htm

The hierarchy of precedence for the permissions can be summarized as follows, with the higher precedence permissions listed at the top of the list:

  • Explicit Deny
  • Explicit Allow
  • Inherited Deny
  • Inherited Allow

Also true: File permissions override folder permissions, unless the Full Control permission has been granted to the folder.

I do not understand this paragraph : File permissions override folder permissions, unless the Full Control permission has been granted to the folder

Are we talking about a folder with a file in it? Does it mean that if the folder contains a file that has Allow Full control permission, the file in that folder will have all the permissions, even if the file is set to Deny Write?


What it means, is (as an example):

User "DOMAIN\jcitizen" was given read-only access to the directory C:\fakepath, and in this folder, exists a file called "document.docx". At this point in time, jcitizen can open the file to read it's contents, however can not save any changes.

3 months later, jcitizen's manager created another file, called "adobe.pdf" and placed it in C:\fakepath. The manager decided that jcitizen was to have the ability to save changes to and make changes to access permissions on document.docx, so they explicitly set Full Control permissions on C:\fakepath\document.docx for jcitizen.

As explicit permissions override inherited permissions, when jcitizen tries to save any changes to document.docx (such as adding a new paragraph of text and giving read-only access to DOMAIN\jdoe) the read-only permissions it inherited from C:\fakepath were effectively made redundant and the file system listens to the explicit permissions.

Now, 6 months later on, jcitizen's manager decides to give everyone Full Control permissions on C:\fakepath. As Full Control permission is the highest-level of file/folder permission that can be granted to a user (as it can also take ownership of a file or folder), it supersedes any explicit permissions set on any files or folders below it.

In a corporate environment, it is always advisable to NEVER give Full Control to any network user. The only people or groups that should ever have Full Control are Domain Admins. When I rebuilt the network (as well as the two file servers running DFS) for the company I work for, I didn't even give our director's day-to-day account Full Control permissions, and opted to give them a second account with Domain and Enterprise Admin privileges.

I hope this clears it up for you.

  • Thank you for your very careful reply. I understand most of the story you're talking about, and am trying to connect with the content above. – quangkid Aug 17 '20 at 7:11
  • What is it you are trying to understand about it? – Christopher H Aug 17 '20 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.