Dear Sirs/Madam,

I have read the "MCSE Training Kit for Win2K Professional" in the NTFS folder permissions lesson (P.310) and found some confusion. What is the difference between the "Read" and "Read & Execute" permission when applying to a NTFS folder?
I have created a NTFS folder with "Read" permission and also another folder with "Read & Execute" permission for a user account in my notebook (running Win2K professional). When I login using the user account, I can browse both folders and their subfolders. No obvious difference is found.

Can you guys help me on this problem?

Thank you very much.

Thomas

Report this post to a moderator

Here's some info:

Read allows you to:
List Folder/Read Data
Read Attributes
Read Extended Attributes

Read & Execute allows you to:
Traverse Folder/Execute Files
List Folder/Read Data
Read Attributes
Read Extended Attributes

List Folder Contents gives you the same special permissions as Read & Execute. But..although List Folder Contents and Read & Execute appear to have the same special permissions, these permissions are inherited differently. List Folder Contents is inherited by folders but not files, and it should only appear when you view folder permissions. Read & Execute is inherited by both files and folders and is always present when you view file or folder permissions.

From a viewing directory contents standpoint, there is no difference, but if you had an executable file in a folder with just Read permission, you can't run it.

Hope this Helps!
Spid
Net+, MCSE

[This message has been edited by Spid (edited 01-05-2001).]

Report this post to a moderator

Hi Spid,
Thanks for your reply.
But I still concern a situation as follows:

If I set the executable file stored in the folder (with READ permission only) with a read/execute permission., can I still browse/run the file in the folder?

Thank You very much.

Thomas

quote:

---

Originally posted by Spid:
Here's some info:

Read allows you to:
List Folder/Read Data
Read Attributes
Read Extended Attributes

Read & Execute allows you to:
Traverse Folder/Execute Files
List Folder/Read Data
Read Attributes
Read Extended Attributes

List Folder Contents gives you the same special permissions as Read & Execute. But..although List Folder Contents and Read & Execute appear to have the same special permissions, these permissions are inherited differently. List Folder Contents is inherited by folders but not files, and it should only appear when you view folder permissions. Read & Execute is inherited by both files and folders and is always present when you view file or folder permissions.

From a viewing directory contents standpoint, there is no difference, but if you had an executable file in a folder with just Read permission, you can't run it.

Hope this Helps!
Spid
Net+, MCSE

[This message has been edited by Spid (edited 01-05-2001).]

---

Report this post to a moderator

quote:

---

Originally posted by hktmah:

If I set the executable file stored in the folder (with READ permission only) with a read/execute permission., can I still browse/run the file in the folder?

Thank You very much.

Thomas

---

Report this post to a moderator

Hi Spid,

Thank You for your reply.

With reference to my question and your replies, I have the following enquiry:

In the Microsoft Training Kit, it says that the Read & Execute permission allows you to "Traverse folder/Execute File". The "Traverse Folder" action can be done with the Read Only permission for the folder as I mentioned in the original question. If it is so, should "Traverse Folder" mention in the Read Only permission in the Training Kit/Microsoft Document?

Thomas

Report this post to a moderator

I did a little research on Technet:

The Traverse Folder/Execute File special permission allows or denies moving through folders to reach other files or folders, even if the user has no permissions for the traversed folders. This permission takes effect only when the group or user is not granted the Bypass Traverse Checking user right in the Group Policy. I believe this is granted to Everyone by default.

Bypass Traverse Checking allows the user to pass through directories to which the user otherwise has no access, while navigating an object path in any Windows file system or in the registry. This privilege does not allow the user to list the contents of a directory, only to traverse directories.

I personally haven't had to tighten things down to this level with NTFS security, so it would take some testing to see the difference, but it sounds interesting.

If I've got some time today, I'll mess around with it.

Sorry I couldn't be 100% sure on this.

Hope this Helps!

Spid
Net+, MCSE

[This message has been edited by Spid (edited 01-08-2001).]

Report this post to a moderator

Hi Spid,

Thank You for your repsonse. As far as the 70-210 exam or other MCSE exams are concerned, how detail do I need to know the NTFS permissions applied to folder/file?
Can you recommend a good book/document for this topic?

I am going to sit for exam soon.

Thank You for your help.

Thomas

Report this post to a moderator

Hi Thomas,

I'm not really sure how detailed you need to get with the NTFS permissions on the 70-210 exam. I know that with the NT4 track exams that I took, if you understood what permission a particular user would have on a folder by combining the Share and NTFS permissions based on the groups that user was in as well as the effect moving/copying folders/files has on NTFS permissions, you'd be fine. The NT4 exams really didn't hammer you with NTFS special permission questions.

Currently, I'm working through the MCSE self-paced training kit for Win2K Pro, as well as doing hands-on. In addition, I've picked up the Exam Cram book for 70-210 exam and purchased the Troytech Study Guide. I may snag the Transcenders practice exams as well (if my compnay will pay for them)

I've seen posted here that these are nice compliments in preparing for the 70-210 exam.

Good luck to you, and let me know if I can help you further.

Spid
Net+, MCSE

Report this post to a moderator

I'm still confused as to what is meant by Traverse. Does this mean that a user can just see the names of the folders (not files) as they move through directories looking for the folder they need?

Report this post to a moderator