Creating and Managing Folders Objectives Identify and understand the differences between the various file systems supported Create and manage shared folders Understand and configure the shared folder permissions available Understand and configure the NTFS permissions

Objectives (continued) Determine the impact of combining shared folder and NTFS permissions Convert partitions and volumes from FAT to NTFS

File System Types Three main file systems File Allocation Table (FAT) FAT32 NTFS Final choice of file system depends on How system will be used Whether there are multiple operating systems Security requirements NTFS is most highly recommended

FAT Used by MS-DOS Supported by all versions of Windows since Traditionally limited to partitions up to 2 GB Limitations Small partition sizes No file system security features Disk space usage is poor

FAT32 A derivative of the FAT file system Supports partition sizes up to 2 TB Still does not provide advanced security features Cannot configure permissions on file and folder resources

NTFS Introduced with Windows NT operating system Current version (version 5) Windows NT 4.0 Windows 2000 Windows XP Windows Server 2003 Windows Server 2008 (Version 6, self-healing) Theoretically supports partition sizes of up to 16 Exabytes (EB) Practically supports maximum partition sizes from 2 TB to 16 TB

NTFS (continued) Advantages of NTFS Self-healing, fix-up damaged structure without locking out the entire volume Greater scalability and performance on larger partitions Support for Active Directory on systems configured as domain controllers Ability to configure security permissions on individual files and folders Built-in support for compression and encryption Ability to configure disk quotas for individual users Support for Remote Storage Recovery logging of disk activities

Creating and Managing Shared Folders A data resource made available over a network to authorized network clients Specific permissions required for creating, reading, modifying Groups that can create shared folders: Administrators Server Operators Power Users (only on member servers)

Creating and Managing Shared Folders (continued) Server Manager under Share and Storage Management allows shared folders to be monitored Can create, maintain, and share folders Folders can be on any drive connected to the computer Shared name of folder does not have to be the actual file name

Creating and Managing Shared Folders (continued) Allows you to share and monitor folders for local and remote computers Allows you to stop sharing if desired Used to provide preconfigured or manual permissions All users have read-only access Administrators have full access; others have read-only access Administrators have full access; others have read and write access Custom share and folder permissions

Monitoring Access to Shared Folders Monitoring involves Who is using shared files What shared files are open at any given time Other functions Disconnect users from a share Send network alert messages Primary monitoring tool is Computer Management

Managing Shared Folder Permissions A shared folder has a discretionary access control list (DACL) Contains a list of user or group references that have been allowed or denied permissions Each reference is an access control entry (ACE) Accessed from Permissions button on Sharing tab of folder’s properties Permissions only apply to network users, not those logged on directly to local machine

Managing Shared Folder Permissions (continued)

Managing Shared Folder Permissions (continued) To deny access to a user or group Windows Server does not include No Access share permission Must explicitly deny access to each individually Default permission is read access for Everyone group Should be immediately addressed when a share is created Folder permissions are inherited by all contained objects

NTFS Permissions Resources located on an NTFS partition or volume can be given NTFS permissions An administrator must Know how permissions are applied Standard and special NTFS permissions available How effective permissions are determined

NTFS Permission Concepts NTFS permissions are configured via the Security tab NTFS permissions are cumulative Access denial always overrides permitted access NTFS folder permissions are inherited unless otherwise specified NTFS permissions can be set at file or folder level

NTFS Permission Concepts (continued) A new ACE has default permission Read and Read and Execute for files List Folder Contents for folders Has set of standard permissions plus special permissions

NTFS Permission Concepts (continued)

Special NTFS Permissions Can provide more or less access than standard permissions Special permissions accessed from Advanced button in the Security tab on Properties dialog box for resource Permission Entry dialog box enables assignment of permissions and control of inheritance settings

Special NTFS Permissions (continued)

Special NTFS Permissions (continued) Inheritance settings This folder only This folder, subfolders, and files (default) This folder and subfolders This folder and files Subfolders and files only Subfolders only Files only

Special NTFS Permissions (continued)

Special NTFS Permissions (continued)

Determining Effective Permissions Permissions that actually apply to a user can be the result of membership in multiple groups Prior to Windows Server 2003, determining effective permissions was done manually In Windows Server 2003, there is an Effective Permissions tab in Advanced Security Settings dialog box for resource Shows specific permissions for a user or group

Determining Effective Permissions (continued)

Combining Shared Folder and NTFS Permissions NTFS permissions can be combined with share permissions When accessing a share across a network, if both apply, use most restrictive When accessing a file locally, only NTFS permissions apply

Converting a FAT Partition to NTFS For highest security, partitions and volumes should be configured to use NTFS Command-line utility, CONVERT, will convert FAT or FAT32 partitions and volumes to NTFS All existing files and folders are retained CONVERT cannot convert NTFS to FAT or FAT32

Summary Windows Server 2008 supports 3 file systems FAT FAT32 NTFS (preferred) Two types of permissions Shared folder (network only) Tools are Windows Explorer, Computer Management, and NET SHARE command NTFS (local and network) NTFS partitions only

Summary (continued) Permissions Shared folders, 3 standard permissions NTFS, 6 standard and 14 special permissions Permissions are cumulative Effective permissions can be determined from Advanced Security Settings of a resource Shared folder and NTFS permissions can be combined CONVERT utility can convert a FAT or FAT32 partition to the NTFS file system