Unit 1: How Windows is organised · Lesson 3 of 5 · 22 min
NTFS permissions
Audit the access lists on the finance file share and find the folder anyone can change.
mission
- You are
- You are the IT analyst preparing a file server review.
- Situation
- Finance exports payment files to D:\Shares\Finance on SRV-FILE01, and the bank portal picks them up. If anyone could change those files, a fraudster could too.
- Goal
- Read every access entry on the shares and find the risky ones.
- Hand in
- The folder with an overly broad write permission and the fix.
Who gets through the door
Read an ACL with icacls
icacls prints one line per entry. Letters in brackets are the rights, and (I) means the entry was inherited from the parent folder.
icacls D:\Shares\Finance\Exports
D:\Shares\Finance\Exports NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
BRIGHTWATER\finance:(I)(OI)(CI)(M)
Everyone:(OI)(CI)(M)
Successfully processed 1 files; Failed processing 0 files
you should see Three inherited entries and one added directly on this folder: Everyone with Modify.
defender tip (OI) and (CI) mean the entry also applies to files and subfolders inside. F is full control, M modify, RX read and execute, R read.
Rights in plain words
| Command | What it does |
|---|---|
Full control (F) | Everything, including changing the permissions themselves |
Modify (M) | Read, write, delete. Enough to replace a payment file |
Read & execute (RX) | Open files and run programs |
Deny | Checked before allow entries. Use sparingly |
Everyone | Every signed in account, including service and kiosk accounts |
Hunt for broad groups
In the lab, filter the table for Everyone, then for Domain Users. Those groups include accounts nobody thinks about.
Get-ChildItem D:\Shares -Directory -Recurse | Get-Acl | ForEach-Object { $p = $_.Path; $_.Access | Where-Object IdentityReference -in 'Everyone','BRIGHTWATER\Domain Users' | Select-Object @{n='Path';e={$p}}, IdentityReference, FileSystemRights }
Path IdentityReference FileSystemRights
---- ----------------- ----------------
D:\Shares\Finance\Exports Everyone Modify, Synchronize
D:\Shares\Operations BRIGHTWATER\Domain Users ReadAndExecute, Synchronize
D:\Shares\Public BRIGHTWATER\Domain Users Modify, Synchronize
D:\Shares\Public Everyone ReadAndExecute, Synchronize
you should see Public is meant to be shared. Finance\Exports is not.
Spot the deny entry
Deny entries win over allow entries. They are sometimes used to fence off a subfolder, and they confuse people during troubleshooting.
icacls D:\Shares\Finance\Payroll
you should see Find the deny entry for this folder in the lab table. It overrides the Modify that the parent folder grants.
The fix
Everyone:(OI)(CI)(M) BRIGHTWATER\finance:(I)(OI)(CI)(M)
Any signed in account can replace a payment file.
icacls D:\Shares\Finance\Exports /remove:g Everyone BRIGHTWATER\finance:(I)(OI)(CI)(M)
Only finance can write. Change it through a ticket and record who asked.
Check where the broad entry comes from
Inherited entries come from the parent folder. Entries set directly stay when you fix the parent, so you must remove them where they are.
you should see Everyone has Modify on Finance\Exports directly, not inherited.
Remove it through a change
Agree the change, then remove the grant and read the ACL again to confirm.
icacls D:\Shares\Finance\Exports /remove:g Everyone icacls D:\Shares\Finance\Exports
you should see The Everyone line is gone and the inherited finance entry still gives the team access.
What a defender takes away
- 1Read every ACL line: who, which right, allow or deny, inherited or explicit.
- 2Everyone and Domain Users with Modify on business data is a finding.
- 3Explicit entries, without (I), were added by a person. Ask who and why.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.