Configuring Data Access and Protection Slides

Configuring Data Access
and Protection
Glenn Weadock
MDAA, MCAAA, MCT, MCSE, MCSA, MCITP, A+, SECURITY+
gweadock@i-sw.com www.i-sw.com
Topics in
This Module NTFS permissions
Shared and public folders
Dynamic Access Control conditions
OneDrive sharing
NTFS Permissions
SIDs are like keys; permissions are
like locks
- SIDs go with users and groups
- Permissions go with objects
Permissions control who can do what

with resources:
- Files and folders
- Printers
- Organizational Units
- Group Policy Objects
We focus on NTFS permissions here,
as OU and GPO permissions are
beyond the scope of this course,
but the same basic principles apply
to these other resources.
NTFS (NT File System)
DACL = Discretionary Access Control List

- For controlling access
SACL = System Access Control List

- For controlling auditing
Each list has one or more entries

Principle of implicit denial
- Not on the list? You don’t get in
Access Control Concepts
Security Access Token Access Control List
Security IDs (SIDs) Access Control Entries

---------------------------- ----------------------------
User: Harry Engineering: Allow Read
Group 1: Engineering Management: Allow Modify
Group 2: Denver Glenn: Deny Modify
(Glenn’s a troublemaker)
NTFS Permission Principles
Creators are owners and control access
Child folders inherit permissions by default
Inheritance can be overridden
(changed to explicit)
“Deny” beats “Allow”
- BUT a child folder Allow can override a
parent folder Deny
ACEs can specify groups or users
Permissions are cumulative
If you move a file or folder to
another folder on the same volume,
it keeps its permissions.
In all other cases (move/copy), it

inherits permissions from the new
parent folder.
Basic and Advanced Permissions
Basic (“simple”) permissions are common
combinations of special permissions
- 95% of what we need
- Read, Read and Execute, and List Folder
Contents are default permissions
- Full Control means can take ownership,
change permissions (e.g. Documents)
- Modify includes ability to Delete
Advanced (“special”) permissions are more

granular values
Basic Permissions
Advanced Permissions
Effective Access Tab
Tab on Advanced Security page

Specify the user, group(s), device
- Play “What if?”
Calculates inherited + explicit permissions

Resolves conflicting group permissions
Omits share-level permissions
System files
and folders
have special
permissions to
help ensure
their security.
If you copy a file to a non-NTFS
volume, such as a FAT32 or exFAT
flash drive, you lose the permissions.
Another Kind of ACL for Auditing
Permissions at the Command Line
ICACLS
- /grant
- /deny
- /reset
Get-Acl, e.g.:
- Get-Acl -Path “c:\folder” | FL
- $OldACL = Get-Acl -Path c:\foldername
Set-Acl, e.g.:
- Set-Acl -Path “c:\newfolder” -AclObject
$OldACL
Demo
NTFS permissions and multiple groups

Shared and Public Folders
File and printer sharing:
Ability to share files and printers on
local machine
ON by default for private and
domain networks
OFF by default for public networks
How to Change File and Printer Sharing
Settings > Network & Internet > Ethernet >

Change advanced sharing options
Network and Sharing Center > Change
advanced sharing settings
- Beware inconsistent verbiage
Windows Firewall
netsh advfirewall firewall set rule
group=“File and Printer Sharing” new
enable=yes
Demo
Activating File and Printer Sharing

Sharing Folders (Not Files!) via File Explorer
Method 1: Right-click, “Give access to”

- Specific people (find and select)
- Specify read or read/write access
- File Explorer, Share tab = same options
Method 2: R-click, Properties, Sharing,

Advanced Sharing
- Specify people and access, plus:
- Limit # of simultaneous users
- Caching (offline settings)
Sharing Folders via (Elevated) Command Line
Net share sharedstuff=c:\sharedstuff

Net share
Net share sharedstuff /delete
New-SmbShare –Name sharedstuff –Path
c:\sharedstuff
Get-SmbShare
Remove-SmbShare –Name sharedstuff
Public Folder Sharing
ON to share Public folder over the network

OFF to keep it unshared
Either way, folder is shared for users of
local machine
Demo
Sharing a folder over the network

What Are Share Permissions?
Remnant of a bygone era (pre-NTFS)

Full Control/Change/Read
Only applies to network path accesses
Combined with NTFS permissions: most
restrictive setting applies
Many administrators set these wide open
Dynamic Access Control Conditions
Limitations of NTFS and
share permissions:
Restrict access based only on user/group
identity (SIDs)
Can’t restrict based on other user or
computer attributes
Can’t restrict based on file attributes
A Bigger, Better Security Access Token
Typical Kerberos SAT has user SID and

group SIDs
For user claims and device claims,
need to expand the SAT
Group Policy to the rescue
Don’t need if you’re just using file
classifications
Creating an Access Condition
User Claim Types
Claim types are based on AD attributes

View AD attributes in:
- ADSI Edit
- AD Users and Computers
- AD Administrative Center
- Schema console
Demo
Viewing user attributes in AD

Device Claim Types
As with user claim types…

Claim types are based on AD attributes
Some attributes can apply to users and
computers, so be careful!
- Department
- Location
- etc.
Requirements for Dynamic Access Control
Windows Server 2012 schema

Server 2012+ file server with
FSRM installed
If using device claims:
- At least 1 Server 2012 or R2 DC per site
- Windows 8+ clients
We can also use custom file
classifications to control access…
…but that’s a bit beyond the
scope of this course.
OneDrive Sharing
Types of online storage
from Microsoft:
OneDrive (for consumers = “personal”)
- Free with Microsoft account
OneDrive for Business

- Paid service (part of
Microsoft 365 or SharePoint)
Microsoft Azure
- Paid service (by subscription)
OneDrive for Consumers
Bits ship with Windows 10/11

Need Microsoft account to use
5 GB for free accounts
100 GB for $2/month
Plans can (and do!) change
Setting up OneDrive for Consumers
Set up a Microsoft account

Set up Windows 10/11 to log on with that
account or provide it when signing in to
OneDrive
Run the setup wizard
(Optionally) Set OneDrive to start with
Windows
OneDrive for Business
Latest sync client is unified

Based on SharePoint
Microsoft 365 (cloud); SharePoint
(on-premises)
Company name appears in File Explorer
File Explorer Integration
OneDrive appears in nav pane

- All folders appear by default
- Sync status, share status
- If not logged in, prompt appears
If multiple accounts, icon labels distinguish

work from personal
You can make
OneDrive the default
save location for:
Desktop
Documents
Pictures
You can autosave to
OneDrive for:
Captured
screenshots
Captured photos
and videos
Sharing OneDrive Files
OneDrive.com
- Click file or folder, choose “Share”
• “Email” (share w/individual)
• “Get a link” (share w/anyone)
• “More” (social media services)
File Explorer
- Right-click file or folder, choose “Share”
- Enter email, click “Copy link” or
“More apps”
Sharing Options
Read permission by default

“Allow editing” permission
Set link expiration (OneDrive Premium)
How to Un-Share OneDrive Files?
OneDrive.com
- Click “Shared” in navigation pane
- Right-click shared folder or file
- Choose “Details”
- Links appear at right
- Choose “Manage access”
- Click “X” to disable a share link
“Fetch” Discontinued in Mid-2020
Good work! You’ve finished this course on
Windows 10/11 connectivity and storage!
I invite you to explore other courses
in this learning path. Meanwhile,
thanks for watching.

Configuring Data Access and Protection Slides

Uploaded by

Copyright:

Available Formats

Configuring Data Access and Protection Slides

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Configuring Data Access and Protection Slides

Uploaded by

Copyright:

Available Formats

Configuring Data Access

Permissions control who can do what

DACL = Discretionary Access Control List

SACL = System Access Control List

Each list has one or more entries

Security Access Token Access Control List

Security IDs (SIDs) Access Control Entries

In all other cases (move/copy), it

Advanced (“special”) permissions are more

Tab on Advanced Security page

Calculates inherited + explicit permissions

NTFS permissions and multiple groups

Settings > Network & Internet > Ethernet >

Activating File and Printer Sharing

Method 1: Right-click, “Give access to”

Method 2: R-click, Properties, Sharing,

Net share sharedstuff=c:\sharedstuff

ON to share Public folder over the network

Sharing a folder over the network

Remnant of a bygone era (pre-NTFS)

Typical Kerberos SAT has user SID and

Claim types are based on AD attributes

Viewing user attributes in AD

As with user claim types…

Windows Server 2012 schema

OneDrive for Business

Bits ship with Windows 10/11

Set up a Microsoft account

Latest sync client is unified

OneDrive appears in nav pane

If multiple accounts, icon labels distinguish

Read permission by default

You might also like