1

Alrighty, not sure how to word this but:

Where do the NTFS permissions themselves get created? For example, I can set "Full Control" or "Read", but where are those programmed at?

Here is why I ask:

I noticed that when I am in other programs (such as Active Directory) and I click the "Security Tab" on the item it allows me to set the NTFS permissions for the item itself (such as a user or an OU).

But there are different options in there! They have Full Control and Read and Write and many of the same ones that regular files have but they also have tons of other ones (see my two pics to see what I mean).

So it made me wonder, where are those selectable permissions created and stored?

Also, can I create my own objects to make custom NTFS permissions inside there?

I have a hunch that this is programmed at the Windows level and only Microsoft themselves can change those things, but I really would like to get a deeper understanding of where those lists come from.

Thank you!

Here are the regular NTFS options on a file: Regular NTFS options

Here are the NTFS options available on a domain object: ADDS NTFS options P.S. I am a computer programmer as well and almost asked this on SO because I am also interested in the code side of this, but it seemed more appropriate for SF.

1 Answer 1

1

On Windows NT based operating system, many types of objects have security descriptors applied to them. Here is an incomplete list:

files, devices, mailslots, pipes, jobs, processes, threads, events, 
access tokens, volumes, window stations, desktops, network shares, 
services, registry keys, printers, Active Directory objects. 

The Security descriptor for each object describes who can do what with the object based on the permissions of the user.

How and where these are stored depends on the type of the object. For files the security descriptor comes in the form of discretionary access control lists (DACLs) and are stored in NTFS attributes alongside the content of the file.

For Active Directory object, the security information is stored with the object in the AD database. While you can change the AD-schema and, I don't think you can change the permissions available for the various objects. These are built into the OS itself.

Where do the permissions come from? In NTFS if you create a new file, it usually inherits the permissions of its parent container.

Otherwise the program that creates an object can set the permissions at the time of creation and it is up to the programmer which permissions to set.

2
  • Thank you for the answer! You sort of hit what I was asking but I think I should explain my question a bit more. I understand NTFS permissions, inheritance, ACL's, etc. I didn't mean "where do they come from" to be about inheritance. I meant like the list of selectable permissions in the list, who decides what is on that list to select in the first place? You did sort of touch on it though when you said it is built into the OS itself which is what I suspected as well. Like if I made my own object that was a "car" could I make my own NTFS permission "drive" which gives users that permission?
    – Ryan
    Dec 13, 2019 at 17:58
  • 1
    @Ryan, if you would work on the Microsoft Windows team and would decide to introduce a new object car, you would decide what type of permissions are applicable to it and program them into the feature. But there is no Windows API that supports you in doing this for your own objects/projects. You have to do this yourself. Dec 15, 2019 at 14:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .