Explanation :File permissions override folder permissions, unless the Full Control permission has been granted to the folder

Question

According to the article: http://ntfs.com/ntfs-permissions-precedence.htm

The hierarchy of precedence for the permissions can be summarized as follows, with the higher precedence permissions listed at the top of the list:

• Explicit Deny
• Explicit Allow
• Inherited Deny
• Inherited Allow

Also true: File permissions override folder permissions, unless the Full Control permission has been granted to the folder.

I do not understand this paragraph : File permissions override folder permissions, unless the Full Control permission has been granted to the folder

Are we talking about a folder with a file in it? Does it mean that if the folder contains a file that has Allow Full control permission, the file in that folder will have all the permissions, even if the file is set to Deny Write?

Answer 1

What it means, is (as an example):

User "DOMAIN\jcitizen" was given read-only access to the directory C:\fakepath, and in this folder, exists a file called "document.docx". At this point in time, jcitizen can open the file to read it's contents, however can not save any changes.

3 months later, jcitizen's manager created another file, called "adobe.pdf" and placed it in C:\fakepath. The manager decided that jcitizen was to have the ability to save changes to and make changes to access permissions on document.docx, so they explicitly set Full Control permissions on C:\fakepath\document.docx for jcitizen.

As explicit permissions override inherited permissions, when jcitizen tries to save any changes to document.docx (such as adding a new paragraph of text and giving read-only access to DOMAIN\jdoe) the read-only permissions it inherited from C:\fakepath were effectively made redundant and the file system listens to the explicit permissions.

Now, 6 months later on, jcitizen's manager decides to give everyone Full Control permissions on C:\fakepath. As Full Control permission is the highest-level of file/folder permission that can be granted to a user (as it can also take ownership of a file or folder), it supersedes any explicit permissions set on any files or folders below it.

In a corporate environment, it is always advisable to NEVER give Full Control to any network user. The only people or groups that should ever have Full Control are Domain Admins. When I rebuilt the network (as well as the two file servers running DFS) for the company I work for, I didn't even give our director's day-to-day account Full Control permissions, and opted to give them a second account with Domain and Enterprise Admin privileges.

I hope this clears it up for you.