High School IntermediateModule I3Lesson 2 of 8

I3.2 File Permissions and Shared Folders

Review fictional Windows files, folders, shares, owners, groups, inherited rules, explicit rules, effective access, classification, and business need using least-privilege principles.

Lesson Progress

File Permissions and Shared Folders

High School IntermediateI3: Windows Security Basics • Lesson 2 of 8

25% complete

Readiness Check

Before You Start

0/5 ready

Professional Hook

A Folder Can Look Private While Still Being Broadly Accessible

A user may gain access through a direct entry, inherited rule, nested group, local group, share permission, application identity, or administrative role. Defenders must follow the complete access path rather than trusting one visible permission.

Weak response

“The folder lists only the project group, so access must be correct.”

Strong response

“Review ownership, inheritance, explicit entries, nested groups, share access, effective access, classification, and approved need.”

Objective 1

Explain how Windows file and folder permissions, ownership, inheritance, local groups, and shared-folder access work together.

Objective 2

Distinguish explicit permissions, inherited permissions, allow entries, deny entries, ownership, share permissions, and effective access.

Objective 3

Evaluate fictional access using data classification, approved role, owner, business need, group membership, and least privilege.

Objective 4

Identify broad, stale, duplicate, inherited, conflicting, and ownerless access without changing real systems.

Objective 5

Create a professional permission-review report with findings, confidence, owners, controlled corrections, validation, rollback, and review dates.

Why This Matters

Permissions Protect Confidentiality, Integrity, and Availability

Read access affects confidentiality. Write, modify, and delete access affect integrity and availability. Full control can also change who receives access. A clear permission model protects data while preserving legitimate work.

Permission Levels

Match Access Level to Approved Need

Read

Allows viewing file contents, folder listings, and basic metadata under the applicable conditions.

Main risk

Sensitive information may be exposed even when users cannot modify it.

Defender question

Does this role need to view this data, and is the classification appropriate for the audience?

Write

Allows creating or changing content within the scope of the granted permission.

Main risk

Users may alter data, introduce unsafe files, or create integrity and accountability problems.

Defender question

Does the role need to create or update content, or would read-only access be enough?

Modify

Typically includes reading, writing, changing, and deleting content.

Main risk

Deletion and broad content changes can cause data loss or operational disruption.

Defender question

Is deletion required for the approved workflow, and are backups and ownership clear?

Full control

Allows broad use of the resource and may include changing permissions or ownership.

Main risk

Excessive control can allow access expansion, permission changes, and destructive actions.

Defender question

Why is this level necessary, and can a narrower role-based permission replace it?

Deny

Explicitly blocks an action under the relevant permission calculation.

Main risk

Deny entries can create confusing and unexpected results when users belong to multiple groups.

Defender question

Is the deny rule necessary, documented, and tested against all required roles?

Special permissions

Granular combinations controlling specific actions such as listing, reading attributes, deleting, or changing permissions.

Main risk

Complex entries can be difficult to review and may hide unintended access paths.

Defender question

Can the design be simplified into clear role-based groups and standard permission sets?

Core Concept

Effective Access Is the Result of Multiple Layers

A user's final access may depend on direct entries, inherited entries, local groups, nested groups, explicit deny rules, share permissions, application controls, and the path used to reach the resource. No single line tells the complete story.

Identity

Which user, group, or service is requesting access?

Path

Which local, shared, linked, or application path is used?

Rules

Which explicit, inherited, allow, and deny entries apply?

Purpose

What approved role or workflow requires access?

Result

What can the identity actually do under the reviewed conditions?

Inheritance and Exceptions

Follow the Complete Permission Path

Parent-to-child inheritance

A child file or folder may receive access rules from its parent, creating consistent permission structures.

Review evidence

Parent path, inherited entries, inheritance state, and any child-level exceptions.

Inheritance disabled

A child object may stop receiving future parent changes and keep or remove previously inherited entries.

Review evidence

Inheritance status, conversion history, explicit entries, owner, and change record.

Explicit exception

A directly assigned rule may create more or less access than the parent design.

Review evidence

Specific user or group entry, permission level, approver, purpose, expiration, and review date.

Nested groups

A user may receive access indirectly through one group that belongs to another group.

Review evidence

Complete group path, role ownership, current membership, and effective-access calculation.

Conflicting entries

Users may receive permissions from multiple groups, explicit rules, inherited rules, or deny entries.

Review evidence

All applicable entries, membership paths, share access, local access, and final effective result.

Moved or copied objects

Permission behavior may change depending on destination, method, ownership, and inheritance.

Review evidence

Original path, destination, operation type, resulting permissions, owner, and validation results.

Folder Models

Different Shared Resources Need Different Reviews

Local-only folder

Used directly on the Windows device by local users, applications, or services.

Check local ownership, inherited and explicit permissions, profile or application need, and data classification.

Network-shared folder

Reached through a share name from another authorized device or user.

Check both share permissions and local file permissions, network scope, group access, owner, logging, and business purpose.

Team project share

Used by a defined project, class, department, or operational team.

Check role groups, project dates, owners, stale members, read versus modify needs, and offboarding.

Public or broad internal share

Available to a large internal population or all authenticated users.

Confirm classification, intended audience, write restrictions, monitoring, and whether broad access is still justified.

Administrative share or protected location

Used for approved management, deployment, support, or system operations.

Check administrator scope, separate support identities, logging, time-bounded access, and business owner approval.

Application data folder

Used by a service, application, scheduled task, or system component.

Check service identity, executable path, required permissions, user access, backup, update, and dependency evidence.

Key Vocabulary

Windows Permission and Sharing Terms

Permission

A rule that allows or restricts actions such as reading, writing, modifying, deleting, or changing access.

Ownership

The recorded relationship between an account and a file or folder, often affecting who can change permissions.

Inheritance

The process by which a child file or folder receives permissions from a parent folder.

Explicit permission

A permission applied directly to a specific file or folder rather than inherited from a parent.

Effective access

The final access result after relevant user, group, inherited, explicit, allow, deny, and sharing rules are considered.

Share permission

An access rule applied when a folder is reached through a network share.

Local permission

An access rule applied directly to files or folders on the Windows device.

Security principal

A user, group, service identity, or other identity to which access rules can be assigned.

Least privilege

The practice of granting only the access required for an approved task and no more.

Access control entry

A specific rule that assigns permissions to a user or group.

Broad access

Access granted to a large group or population beyond the narrow approved need.

Stale access

Access that remains after the original role, project, owner, or business need has ended.

Evidence Analysis

What Permission Evidence Can and Cannot Prove

Evidence source

Permission list

Can support

Users, groups, inherited entries, explicit entries, allow or deny rules, and assigned permission levels.

Limitation

Does not prove current business need, complete group nesting, or network-share effects.

Evidence source

Ownership metadata

Can support

Which identity is recorded as owner and may have authority to manage access.

Limitation

Does not prove the owner is current, appropriate, or actively responsible.

Evidence source

Group membership

Can support

Direct and indirect role membership that may grant access.

Limitation

Does not prove the role remains approved or that every nested group is visible in one record.

Evidence source

Share configuration

Can support

Share name, allowed users or groups, access level, network scope, and availability.

Limitation

Does not prove the final local file permission or actual business need.

Evidence source

Effective-access result

Can support

The calculated access outcome for a specific identity under the reviewed conditions.

Limitation

May not include application-level controls, offline copies, alternate paths, or future group changes.

Evidence source

File and folder classification

Can support

Expected sensitivity, handling requirements, owner, retention, and approved audience.

Limitation

Labels may be missing, outdated, or inconsistent with actual content.

Evidence source

Usage and audit records

Can support

Observed access, modification, deletion, sharing, or ownership activity under available logging.

Limitation

Absence of recorded use does not prove no access occurred or no future need exists.

Evidence source

Owner and project records

Can support

Approved purpose, role groups, project dates, owner, expiration, and review requirements.

Limitation

Documentation may be stale or may not match the technical permission state.

Defensive Workflow

Complete a Permission Review in Six Steps

1

Define resource and purpose

Identify the fictional path, owner, classification, application or project role, and approved audience.

2

Collect permission evidence

Record ownership, inherited and explicit entries, group membership, share permissions, and effective access.

3

Map access paths

Connect direct users, nested groups, services, applications, network shares, alternate paths, and profile locations.

4

Compare with approved need

Check whether each user or group needs read, write, modify, full control, or no access.

5

Classify findings

Separate confirmed broad access, stale access, inheritance problems, owner gaps, evidence gaps, and unsupported claims.

6

Plan controlled correction

Assign an owner, preserve evidence, test the change, define rollback, validate applications and users, and document the new baseline.

Fake Dashboard

Fake Windows Permission Governance Dashboard

Training dashboard for the fictional Meadowbrook Learning Services shared-resource environment.

Shared folders reviewed

28

Twelve project shares, six department shares, four application folders, and six broad internal shares.

Broad write-access findings

5

Five folders allow modification by groups larger than the approved editing population.

Ownerless permission exceptions

7

Seven explicit user or group entries have no current owner, expiration, or change record.

Fake SOC Alert

Internal Deployment Folder Writable by Broad Staff Group

Source: Fake Windows Access Governance Monitor • Time: 02:18 PM

High Severity
The fictional share \\training-files\deployment-notes is classified internal. The Deployment Editors group needs modify access, but the All Staff group receives inherited modify access from the parent share. The owner confirms that general staff should have read-only access.
Defensive recommendation: Preserve ownership, inheritance, group, share, effective-access, classification, and usage evidence; test a role-based permission correction; remove broad modify access through approved change; and validate editor, reader, service, backup, and application workflows.

Fake Log Panel

Fake Windows Shared-Folder Review Timeline

training-log-viewer.log
13:41:00 RESOURCE path='\\training-files\deployment-notes' classification='internal' owner='deployment-ops'
13:44:19 SHARE group='All Staff' permission='Change'
13:46:02 LOCAL inherited_group='All Staff' permission='Modify' source='D:\Shared'
13:47:51 LOCAL explicit_group='Deployment Editors' permission='Modify'
13:50:14 GROUP nested_member='Contractor Team' parent='All Staff'
13:53:28 EFFECTIVE user='sample-contractor' access='Modify'
13:58:43 OWNER intended_editors='Deployment Editors' intended_readers='All Staff'
14:03:10 USAGE staff_modifications='0' editor_modifications='42'
14:09:26 CHANGE test_group='Deployment Editors' validation='passed'
14:18:05 CORRELATION finding='broad_inherited_modify_access' confidence='high'

Training note: this is fake data for defensive analysis practice only.

Analyze the Evidence

Which Permission Decision Is Best Supported?

The fictional folder is classified internal.
The Deployment Editors group needs modify access.
The All Staff group should have read-only access.
All Staff currently receives modify access through both share and inherited local permissions.
A contractor group is nested inside All Staff.
Usage records show no general-staff modification activity.
The owner approves a role-based correction and the editor test passes.

What is the strongest next action?

Common Mistakes

Mistakes That Weaken Permission Reviews

Reviewing only one permission entry instead of the complete effective-access path.
Ignoring nested group membership.
Checking only share permissions and not local file permissions.
Assuming inherited permissions are correct because they came from a parent folder.
Adding explicit deny entries without understanding their effect on multiple groups.
Granting full control when modify or read access would be enough.
Assigning access directly to many users instead of using clear role-based groups.
Removing access without checking service, application, scheduled-task, backup, or workflow dependencies.
Treating no recent access as proof that the permission is unnecessary.
Leaving project groups unchanged after team membership or project dates change.
Changing ownership without documenting the responsible business owner.
Publishing real paths, usernames, group names, permission lists, or internal share names in a portfolio.

Safe Practice Lab

Complete a Fictional Windows Permission Review

Fictional Environment

Northstar Shared Resource Assessment

Review twelve fictional folders across project, department, public-internal, application, administrative, and local-user use cases.

Required Analysis

  1. Record path, owner, classification, purpose, and approved audience.
  2. List inherited and explicit permissions.
  3. Map direct users, nested groups, services, applications, and shares.
  4. Calculate fictional effective access for selected identities.
  5. Identify broad, stale, duplicate, conflicting, and ownerless entries.
  6. Assign risk, confidence, owner, expiration, and review date.
  7. Write a tested correction, rollback, validation, and baseline-update plan.
Use only supplied fictional evidence. Do not open, share, move, delete, encrypt, copy, or change permissions on any real file, folder, share, device, account, or service without explicit authorization.

Scenario Decision Lab

A Project Ended but Its Write Group Still Exists

A fictional project share remains available after project completion. The Project Editors group still has modify access, but no current project owner is assigned and retention rules require the data to remain read-only for one year.

Scenario Decision Lab

A Service Stops Working After a Permission Change

A fictional application service can no longer write to its approved data folder after broad user permissions are reduced. The service identity's exact required access was not tested before the change.

Defender Habits

Windows File Permission and Shared Folder Checklist

Check Your Understanding

I3.2 Mini Quiz: File Permissions and Shared Folders

Choose your answers first. Explanations appear only after submission.

1. What is effective access?

2. Why can inherited permissions create risk?

3. What should be reviewed for a network-shared folder?

4. Why is direct user-by-user access usually harder to manage than role-based group access?

5. A user has not opened a project folder recently. What is the strongest conclusion?

6. Which evidence best supports removing write access from a broad staff group?

7. What should happen after changing folder permissions?

Portfolio Prompt

Portfolio Prompt

Create a fictional Windows File Permission and Shared Folder Review for twelve resources. Include path, owner, classification, purpose, approved audience, local permissions, share permissions, inheritance, explicit entries, groups, nested groups, service identities, effective access, usage, finding, confidence, risk, owner, correction, test, rollback, validation, and review date.

Use only fictional devices, paths, share names, users, groups, services, applications, and organizations.
Include one broad inherited permission, one nested-group issue, one stale project group, one service dependency, and one ownerless exception.
Show the difference between share permissions and local file permissions.
Do not include real folder names, internal share paths, usernames, group names, or permission screenshots.

Key Takeaways

What You Should Remember

1.Windows effective access depends on users, groups, inheritance, explicit rules, deny rules, ownership, and sharing layers.
2.Read, write, modify, and full control create different confidentiality, integrity, and availability risks.
3.Inherited permissions are efficient but can spread broad access into sensitive child folders.
4.Network shares require review of both share permissions and local file permissions.
5.Role-based group access is easier to govern than many direct user entries.
6.Strong corrections preserve dependencies, use least privilege, validate approved workflows, and document the new baseline.

Navigation

Continue Module I3