In Windows operating systems, specifically on NTFS and ReFS volumes, users have the ability to control access to files and folders through security permissions. These permissions dictate who can access, modify, or delete these digital entities. Every folder or file on a computer contains access control information called a security descriptor. This descriptor acts as a gatekeeper, regulating the access levels for users and groups. It automatically generates upon creating the folder or file. See How to Grant Local Admin Permissions to a Group [Part 1].
User and Group Permissions
Users who are part of certain groups, like “Administrators,” have the authority to manage permissions on objects associated with those groups. For objects that a user owns, they are granted full control.
The system intricately ties permissions to an object’s security descriptor, assigning them to specific users and groups. For instance, the “Administrators” group might receive permissions like Read, Write, and Delete for a file named System.dll.
Please see Set Special File Permissions with SUID or GUID and Sticky Bit in Linux, Pleasant User Group Permission and User Access, How to grant public access to S3 Bucket using Policy, and how to Add or delete users and set permissions in Azure AD.
Access Control Entries (ACE) and Access Control Lists (ACL):
The system represents each assignment of permissions as an access control entry (ACE). It refers to the collection of these entries within a security descriptor as an access control list (ACL). For instance, a file may have permission entries for both the Administrators and Backup Operators groups.
Types of Permissions
There are two main types of permissions: explicit and inherited. The Explicit permissions are set directly on objects, while inherited permissions are passed down from parent objects.
Explicit Permissions
These explicit permissions are either automatically assigned to non-child objects upon creation or set manually by a user on objects that are not descendants, including both parent and child objects.
Inherited Permissions
Inherited permissions are those inherited from parent objects, ensuring uniformity and simplifying permission management across a container. It’s important to note that inherited deny permissions do not override explicit allow permissions.
Enabling or Disabling Inherited Permissions
Now, let’s delve into the practicalities of enabling or disabling inherited permissions for files and folders in Windows system. But first, you need an administrative right to perform these steps.
Method 1: Enable Inherited Using Advanced Security Settings
Right-click on the file or folder of interest and select “Properties.”
Click on the “Security” tab and then tap “Advanced.” If needed, click on “Change permissions.”
Click “Enable inheritance” for the file to inherit the account permission.
Click Apply for the inherited permissions to take effect.
Once the inheritance is applied, you should see other permissions listed in the permission entries.
Method 2: Disable Inherited Using Advanced Security Settings
Within File Explorer, locate the file or folder. Right-click and access “Properties.”
Select the “Security” tab and click “Advanced.” If needed, click on “Change permissions.”
Select “Disable inheritance” to remove the inherited permission.
When prompted, select “Remove all inherited permissions from this object.”
Click Apply for the disable permissions change to take effect.
Method 3: Enable or Disable Command Prompt Wizardry
Run command prompt as administrator from the windows Start menu.
Execute the desired command:
To enable inheritance: icacls “Full path” /inheritance:e
To disable inheritance and convert inherited permissions: icacls “Full path” /inheritance:d
To disable inheritance and remove all inherited permissions: icacls “Full path” /inheritance:r
Replace “Full path” with the actual path of the file or folder.
Conclusion
I hope you found this blog post on how to Enable or Disable Inherited Permissions for Files and Folders in Windows Interesting and helpful. In case you have any questions do not hesitate to ask in the comment section.
