Understanding and Changing Windows File and Folder Permissions

Description

Windows uses file and folder permissions to control who can access, modify, delete, or manage files and directories. These permissions help protect sensitive information, prevent unauthorized changes, and manage access to shared resources.

On NTFS-formatted drives, administrators can configure permissions for individual users and groups.

This guide explains how Windows permissions work, how to change them using File Explorer, how inheritance affects access, and how to troubleshoot common permission problems.

Procedure

1. Understanding Windows NTFS Permissions

Windows NTFS permissions determine what actions users and groups can perform on files and folders.

Common permissions include:

Permissions are assigned to users or security groups.

For example, a shared department folder might have the following permissions:

Important: NTFS permissions are evaluated using the user's security token, including applicable group memberships. An explicit Deny entry can override otherwise allowed access, so Deny permissions should be used carefully.

2. Viewing Current File or Folder Permissions

Before changing permissions, inspect the existing configuration.

Step 1: Locate the File or Folder

1. Open File Explorer using Windows + E.
2. Navigate to the file or folder.
3. Right-click the item.
4. Select Properties.

Step 2: Open the Security Tab

1. Select the Security tab.
2. Review the users and groups listed.
3. Select a user or group to view its permissions.

The permissions area displays Allow and Deny settings.

Step 3: Review Advanced Permissions

Click Advanced to open Advanced Security Settings.

This window provides additional information, including:

• Current owner
• Permission entries
• Inheritance settings
• Effective access
• Auditing settings, where available

3. Changing Permissions Using File Explorer

Step 1: Open Security Settings

1. Right-click the file or folder.
2. Select Properties.
3. Open the Security tab.
4. Click Edit.

Step 2: Select a User or Group

Select the account whose permissions need to change.

If the account is not listed, click Add.

Step 3: Assign Permissions

Select the required permission under the Allow column.

For example, to let a user modify documents, select Modify.

Windows automatically includes the standard permissions associated with Modify.

Step 4: Save the Changes

1. Click Apply.
2. Click OK.
3. Close the Properties window.

Step 5: Verify Access

Sign in as the affected user, or test using an appropriate account, and confirm that the intended access works.

Avoid assigning Full Control when Modify or Read permissions are sufficient.

4. Adding a New User or Group

To grant access to a new user or group:

1. Right-click the folder and select Properties.
2. Open Security.
3. Click Edit.
4. Click Add.
5. Enter the username or group name.
6. Click Check Names.
7. Click OK.
8. Assign the appropriate permissions.
9. Click Apply.

For domain environments, verify that the correct domain or location is selected.

Best Practice: Assign permissions to security groups whenever possible. This makes access easier to manage when employees join, leave, or change departments.

5. Understanding Permission Inheritance

Windows folders commonly inherit permissions from their parent directories.

For example:

D:Company
    |
    +-- Accounting
    |      +-- Reports
    |
    +-- Human Resources
           +-- Employee Records

If D:Company grants Read access to a group, subfolders may inherit that permission.

Inheritance reduces the need to configure every folder individually.

Disabling Inheritance

1. Right-click the folder.
2. Select Properties.
3. Open Security.
4. Click Advanced.
5. Select Disable inheritance.

Windows offers two options:

Convert inherited permissions into explicit permissions: Retains the existing entries as independently managed permissions.

Remove all inherited permissions: Removes inherited entries, which can immediately restrict access.

For most administrative changes, converting inherited permissions is safer because it preserves the existing entries while allowing modifications.

Warning: Disabling inheritance incorrectly can prevent users, services, or administrators from accessing important resources.

6. Changing File or Folder Ownership

Ownership determines which account has authority over an object's security settings.

Administrators may need to change ownership when files belong to deleted accounts or when restoring data from another system.

Steps to Change Ownership

1. Right-click the file or folder.
2. Select Properties.
3. Open Security.
4. Click Advanced.
5. Locate the Owner field.
6. Click Change.
7. Enter the intended user or group.
8. Click Check Names.
9. Click OK.
10. Apply the changes.

For directories, the option to replace the owner on subcontainers and objects may also be available.

Changing ownership does not automatically grant the new owner every file access permission. Review the permission entries afterward.

7. Managing Permissions Using icacls

Windows includes the icacls command-line utility for viewing and modifying NTFS permissions.

Open Command Prompt or PowerShell with the appropriate privileges.

View Current Permissions

icacls "C:Shared"

Grant Read Access

icacls "C:Shared" /grant "Users:(RX)"

Grant Modify Access

icacls "C:Shared" /grant "Staff:(OI)(CI)M"

The flags (OI) and (CI) indicate object and container inheritance, allowing the entry to apply to child files and folders.

Remove Explicit Permissions for an Account

icacls "C:Shared" /remove:g "Staff"

This removes explicit Allow entries for the specified account or group. It does not necessarily remove inherited entries.

Back Up Permissions

icacls "C:Shared" /save "C:acl-backup.txt" /T

This saves access control lists for the specified directory tree. The backup location must be writable, and the command does not back up file contents.

Restore Permissions

icacls "C:" /restore "C:acl-backup.txt"

Restore operations require an appropriate parent path and a compatible ACL backup. Test restoration procedures before using them in production.

Security Warning: Incorrect icacls commands can change permissions on large numbers of files. Verify the target path and test commands on noncritical data first.

8. Troubleshooting Access Denied Errors

Issue: Access Denied When Opening a Folder

Possible Cause: The user lacks Read or folder traversal permissions.

Solution:

1. Open the folder's Security settings.
2. Review the affected user's group memberships.
3. Check inherited and explicit permissions.
4. Use the Effective Access tab to evaluate access.
5. Grant the minimum required permissions.

Issue: Cannot Save or Modify a File

Possible Cause: The user has Read access but lacks Write or Modify permissions.

Solution:

1. Open the file's Security properties.
2. Check the assigned permissions.
3. Confirm the file is not marked read-only.
4. Check whether another application has locked the file.
5. Grant appropriate Write or Modify access if authorized.

Issue: Access Denied After Moving Files

Possible Cause: The moved or copied files may have retained or inherited different permissions, depending on the operation, filesystem, and tools used.

Solution:

1. Inspect the destination permissions.
2. Check whether inheritance is enabled.
3. Compare access control entries with a working file.
4. Correct the entries according to the destination's security policy.

Issue: User Cannot Access a Network Share

Possible Cause: The user may have sufficient NTFS permissions but insufficient network share permissions.

Solution:

1. Review the folder's NTFS Security settings.
2. Open the folder's Sharing settings.
3. Select Advanced Sharing and review share permissions.
4. Verify the user's group membership.
5. Test access using the network path.

When accessing files through a Windows network share, both share permissions and NTFS permissions apply. The effective access is constrained by both sets of permissions.

9. NTFS Permissions vs. Share Permissions

For network access, the effective permissions depend on both systems.

For example, if share permissions allow Read but NTFS permissions allow Modify, the user is still limited to Read through that share.

10. Security Best Practices

• Follow the principle of least privilege.
• Use security groups instead of assigning permissions individually whenever practical.
• Avoid granting Everyone Full Control.
• Avoid unnecessary explicit Deny entries.
• Preserve SYSTEM and required administrative permissions.
• Document permission changes.
• Back up ACLs before major changes.
• Review inheritance before changing permissions.
• Use Effective Access to troubleshoot complex group memberships.
• Verify access using the intended user account.
• Avoid changing permissions on system folders without a documented requirement.

11. Quick Reference

Addtional Information

Understanding Windows file and folder permissions is essential for maintaining secure systems and resolving access problems.

Administrators should understand how NTFS permissions, ownership, inheritance, and share permissions work together before modifying access.

By following the principle of least privilege and verifying changes, administrators can maintain secure file access while reducing the risk of unauthorized modification or accidental data exposure.