Tag: Windows 2012

6. In the Share Name text box, specify the name you want to assign to the share and click Next.

8. Click Next to move to the Specify Permissions To Control Access page.
9. Modify the default share and NTFS permissions as needed and click Next. The Confirm Selections page appears.

10.  Click Create. The View Results page appears as the wizard creates the share.

    11. Close the New Share Wizard.

    Assigning permissions

    •  Share permissions Control access to folders over a network. To access a le over a network, a user must have appropriate share permissions (and appropriate NTFS permissions if the shared folder is on an NTFS volume).
    • ■  NTFS permissions Control access to the les and folders stored on disk volumes formatted with the NTFS le system. To access a le, either on the local system or over a network, a user must have the appropriate NTFS permissions.Understanding the Windows permission architecture
       To store permissions, Windows elements have an access control list (ACL). An ACL is a collection of individual permissions in the form of access control entries (ACEs). Each ACE consists of a security principal (that is, the name of the user, group, or computer granted the permis- sions) and the specic permissions assigned to that security principal. When you manage per- missions in any of the Windows Server 2012 R2 permission systems, you are actually creating and modifying the ACEs in an ACL.

    Understanding basic and advanced permissions

    The permissions protecting a particular system element are not like the keys to a lock, which provide either full access or no access at all. Permissions are designed to be granular, enabling you to grant speci c degrees of access to security principals.

    EXAM TIP

    Prior to Windows Server 2012, basic permissions were known as standard permissions and advanced permissions were known as special permissions. Candidates for certi cation exams should be aware of these alternative terms.

    For example, the NTFS permission system has 14 advanced permissions you can assign to a folder or le. However, there are also six basic permissions, which are various combinations of the 14 advanced permissions. You can also assign both types of permissions in a single ACE, combining a basic permission with one or more advanced permissions, to create a customized combination. In most cases, however, administrators work only with basic permissions. Many administrators rarely, if ever, have reason to work directly with advanced permissions.

    Allowing and denying permissions

    • ■  Additive Start with no permissions and then grant Allow permissions to individual security principals to give them the access they need.
    • ■  Subtractive Start by granting all possible Allow permissions to individual security principals, giving them full control over the system element, and then grant them Deny permissions for the access you don’t want them to have.

    Inheriting permissions

    The most important principle in permission management is that permissions tend to run downward through a hierarchy. This is called permission inheritance. Permission inheritance means that parent elements pass their permissions down to their subordinate elements.

    • Turn off inheritance When you assign advanced permissions, you can con gure an ACE not to pass its permissions down to its subordinate elements. This effectively blocks the inheritance process.
    • ■  Deny permissions When you assign a Deny permission to a system element, it overrides any Allow permissions that the element might have inherited from its parent objects.
    • Understanding effective access

      A security principal can receive permissions in many ways, and it is important for an adminis- trator to understand how these permissions combine. The combination of Allow permissions and Deny permissions a security principal receives for a given system element—whether ex- plicitly assigned, inherited, or received through a group membership—is called the effective access for that element. Because a security principal can receive permissions from so many sources, it is not unusual for those permissions to overlap.

    •  Allow permissions are cumulative. When a security principal receives Allow permissions from more than one source, the permissions are combined to form the effective access permissions.

    • Deny permissions override Allow permissions. When a security principal receives Allow permissions—whether explicitly, by inheritance, or from a group—you can over- ride those permissions by granting the principal Deny permissions of the same type.
    • • Explicit permissions take precedence over inherited permissions. When a security principal receives permissions by inheriting them from a parent or from group memberships, you can override those permissions by explicitly assigning contradicting permissions to the security principal itself.
      • 0. Setting share permissions
        1. 0.  Windows Server 2012 R2, shared folders have their own permission system, which is independent from the other Windows permission systems. For network users to access shares on a le server, you must grant them the appropriate share permissions.

           1. NOTE BYPASSING SHARE PERMISSIONS

              Many le server administrators simply leave the Allow Full Control share permission to the Everyone special identity in place, essentially bypassing the share permission system, and rely solely on NTFS permissions for granular le system protection. NTFS permissions con- trol access by both local and remote users, rendering share permissions redundant.

              NOTE NTFS PERMISSIONS

              NTFS permissions are not limited to shared folders. Every le and folder on an NTFS volume has permissions. Although this procedure describes the process of assigning permissions to a shared folder, you can open the Properties sheet for any folder in a File Explorer window, click the Security tab, and work with its NTFS permissions in the same way.