What happens when you move a file with NTFS permissions to a different NTFS volume?

What happens to NTFS permissions if you copy or move the files or folders? The answer is: it depends. Read more to learn what happens!

To give you a clearer explanation, consider the following three scenarios. Let’s assume that you are going to copy “D:MyFolder” and let’s assume that “D:” has an NTFS format.

Copying Files between NTFS Partitions

Move D:MyFolder to D:MyFiles

Results:

• The file or folder retains its original NTFS permissions.
• You must have the “Write” permission set up for the destination folder to move files and folders into that folder.
• You must have the “Modify” permission set up for the source file or folder. The “Modify” permission is required to move a file or folder because Windows 2000 deletes files and folders from the source folder after they are copied to the destination folder.
• You become the creator and owner.

Moving Files between NTFS Partitions

Copy D:MyFolder to F:MyFolder

Results:

• The file or folder inherits the NTFS permissions of the destination folder.
• You must have the “Write” permission set up for the destination folder to move files and folders into that folder.
• You must have the “Modify” permission set up for the source file or folder. The “Modify” permission is required to move a file or folder because Windows XP Professional deletes files and folder from the source folder after they are copied to the destination folder.
• You become the creator and owner.

Copying Files

As anyone that has dealt with file server permissions is aware, NTFS has an interesting design feature/flaw known as the Move/Copy problem.

Nội dung chính Show

• Get the Free Pen Testing Active Directory Environments EBook
• What is NTFS?
• NTFS Permissions
• Share Permissions
• A Caveat on Share Permissions
• How to Use Share and NTFS Permissions Together
• Consider the following examples:
• Managing NTFS Permissions and Share Permissions
• What happens to permissions when a file is moved to another location in the same drive?
• What happens to the permissions of a file if you move the file to a folder within the same volume?
• What happens to the existing NTFS permissions after the files are copied to the destination NTFS volume?
• What happens to the NTFS permissions applied to a folder when the folder is moved to a different folder in the same volume?

As explained in this MS KB article, the permissions for a folder or file do not automatically inherit from the parent if the folder is moved and the source and destination are on the same NTFS volume. The permissions are inherited if the folder is copied or if the source and destination are on different volumes.

Here is a quick example:

You have two shared folders on the same NTFS volume called "Technicians" and "Managers". The Technicians group has RW access to the Technicians folder and the Managers group has RW access to the "Managers" folder. If someone has access to both and they move a subfolder from the "Managers" folder to the "Technicians" folder, the folder that is moved is still only accessible to users in the "Managers" group. The "Technicians" group cannot access the subfolder even though it is under the "Technicians" folder and should be inheriting permissions from the top.

As you can imagine, this causes support calls, tickets, and wasted cycles on resolving these end user issues, not to mention the rats nest of permissions that you can end up with if users are often moving folders between different secured folders/area on the same volume.

The questions are:

What is the best way to workaround this NTFS design flaw and how are you handling it in your environment?

I know the linked KB article talks about some registry keys to change the default behavior of Windows Explorer but they are client-side and requires the users to have the ability to change permissions which I would think in most environments is a non-starter if you want to keep control over your file server permissions (and your sanity as a sysadmin).

One of the most critical security concepts is permissions management: ensuring that proper permissions are set with users – and that usually means knowing the difference between share and NTFS permissions.

Share and NTFS permissions function completely separately from each other, but ultimately serve the same purpose: to prevent unauthorized access.

Get the Free Pen Testing Active Directory Environments EBook

However, when NTFS and share permissions interact or when a shared folder is in a separate shared folder with different share permissions, users might not be able to access their data or they can get higher levels of access than security admins intend.

Here are key differences between share and NTFS permissions so you’ll know what to do.

What is NTFS?

A file system is a way of organizing a drive, indicating how data is stored on the drive and what types of information can be attached to files, such as permissions and file names.

NTFS (NT File System) stands for New Technology File System (NTFS). NTFS is the latest file system that the Windows NT operating system uses for storing and retrieving files. Prior to NTFS, the file allocation table (FAT) file system was the primary file system in Microsoft’s older operating systems, and was designed for small disks and simple folder structures.

NTFS file system supports larger file sizes and hard drives and is more secure than FAT. Microsoft first introduced NTFS in 1993 with the release of Windows NT 3.1. It is the file system used in Microsoft’s Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP, Windows 2000, and Windows NT operating systems.

NTFS Permissions

NTFS permissions are used to manage access to the files and folders that are stored in NTFS file systems.

To see what kind of permissions you will be extending when you share a file or folder:

• Right click on the file/folder
• Go to “Properties”
• Click on the “Security” tab

All then you’ll navigate this window:

Besides Full Control, Change, and Read that can be set for groups or individually, NTFS offer a few more permission options:

1. Full control: Allows users to read, write, change, and delete files and subfolders. In addition, users can change permissions settings for all files and subdirectories.
2. Modify: Allows users to read and write of files and subfolders; also allows deletion of the folder.
3. Read & execute: Allows users to view and run executable files, including scripts.
4. List folder contents: Permits viewing and listing of files and subfolders as well as executing of files; inherited by folders only.
5. Read: Allows users to view the folder and subfolder contents.
6. Write: Allows users to add files and subfolders, allows you to write to a file.

If you’ve ever involved in permissions management within your organization, you’ll eventually encounter ‘broken’ permissions. Rest assured, they’re repairable.

When you share a folder and want to set the permissions for that folder – that’s a share. Essentially, share permissions determine the type of access others have to the shared folder across the network.

To see what kind of permissions you will be extending when you share a folder:

• Right click on the folder
• Go to “Properties”
• Click on the “Sharing” tab
• Click on “Advanced Sharing…”
• Click on “Permissions”

And you’ll navigate to this window:

There are three types of share permissions: Full Control, Change, and Read.

1. Full Control: Enables users to “read,” “change,” as well as edit permissions and take ownership of files.
2. Change: Change means that user can read/execute/write/delete folders/files within share.
3. Read: Read allows users to view the folder’s contents.

Sometimes, when you have multiple shares on a server which are nested beneath each other, permissions can get complicated and messy.

For instance, if you have a “Read” folder in a subfolder share permission but then someone creates a “Modify” share permission above it at a higher root, you may have people getting higher levels of access then you intend.

There’s a way around this, which I’ll get to below.

One of the common questions that comes up when you’re configuring security is “what happens when share and NTFS permissions interact with each other?”

When you are using share and NTFS permissions together, the most restrictive permission wins.

Consider the following examples:

If the share permissions are “Read”, NTFS permissions are “Full control”, when a user accesses the file on the share, they will be given “Read” permission.

If the share permissions are “Full Control”, NTFS permissions are “Read”, when a user accesses the file on the share, they will still be given a “Read” permission.

If you find working with two separate sets of permissions to be too complicated or time consuming to manage, you can switch to using only NTFS permissions.

When you look at the examples above, with just three types of permissions setting, shared folder permissions provide limited security for your folders. Therefore, you gain the greatest flexibility by using NTFS permissions to control access to shared folders.

Moreover, NTFS permissions apply whether the resource is accessed locally or over the network.
To do this, change the share permissions for the folder to “Full Control.”

You can then make whatever changes you want to the NTFS permissions without having to worry about the share permissions interfering with your changes.

Cindy Ng

Cindy is the host of the Inside Out Security podcast.

What happens to permissions when a file is moved to another location in the same drive?

When you copy a protected file to a folder on the same, or a different volume, it inherits the permissions of the target directory. However, when you move a protected file to a different location on the same volume, the file retains its access permission setting as though it is an explicit permission.

What happens to the permissions of a file if you move the file to a folder within the same volume?

By default, an object inherits permissions from its parent object, either at the time of creation or when it is copied or moved to its parent folder. The only exception to this rule occurs when you move an object to a different folder on the same volume. In this case, the original permissions are retained.

What happens to the existing NTFS permissions after the files are copied to the destination NTFS volume?

Copying Files between NTFS Partitions Results: The file or folder retains its original NTFS permissions.

What happens to the NTFS permissions applied to a folder when the folder is moved to a different folder in the same volume?

What happens to the NTFS permissions applied to a folder when the folder is moved to a different folder in the same volume? It keeps its previous permissions settings in the new folder.

What happens when a NTFS folder is moved to a different partition or volume?

What happens to the permission of a file when the file is moved within one NTFS volume?

What happens to permissions when a file is moved to another drive?

When moving a folder or file between different NTFS partitions the file or folder does not inherit the destination folder permissions is this statement true or false?