[Previous] [Next]

Lesson 4: Assigning Special Access Permissions

The standard NTFS permissions generally provide all of the access control that you need to secure your resources. However, sometimes the standard NTFS permissions don't provide the specific level of access that you might want to assign to users. To create a specific level of access, you can assign NTFS special access permissions.

After this lesson, you will be able to

• Give users the ability to change permissions on files or folders.
• Give users the ability to take ownership of files and folders.

Estimated lesson time: 5 minutes

Using Special Access Permissions

There are 14 special access permissions. Two of them, shown in Figure 14.5, are particularly useful for controlling access to resources: Change Permissions and Take Ownership.

Figure 14.5 The Change Permissions and Take Ownership special access permissions

When you assign special access permissions to folders, you can choose where to apply the permissions down the tree to subfolders and files.

Changing Permissions

You can give other administrators and users the ability to change permissions for a file or folder without giving them the Full Control permission over the file or folder. In this way, the administrator or user can't delete or write to the file or folder but can assign permissions to the file or folder.

To give administrators the ability to change permissions, assign Change Permissions to the Administrators group for the file or folder.

Taking Ownership

You can transfer ownership of files and folders from one user account or group to another user account or group. You can give someone the ability to take ownership and, as an administrator, you can take ownership of a file or folder.

The following rules apply for taking ownership of a file or folder:

• The current owner or any user with Full Control permission can assign the Full Control standard permission or the Take Ownership special access permission to another user account or group, allowing the user account or a member of the group to take ownership.
• An administrator can take ownership of a folder or file, regardless of assigned permissions. If an administrator takes ownership, the Administrators group becomes the owner and any member of the Administrators group can change the permissions for the file or folder and assign the Take Ownership permission to another user account or group.

For example, if an employee leaves the company, an administrator can take ownership of the employee's files, assign the Take Ownership permission to another employee, and then that employee can take ownership of the former employee's files.

NOTE

---

You cannot assign anyone ownership of a file or folder. The owner of a file, an administrator, or anyone with Full Control permission can assign Take Ownership permission to a user account or group, allowing them to take ownership. To become the owner of a file or folder, a user or group member with Take Ownership permission must explicitly take ownership of the file or folder, as explained later in this chapter.

Setting Special Access Permissions

You assign special access permissions to enable users to change permissions and take ownership of files and folders, as follows:

1. In the Access Control Settings dialog box for a file or folder, on the Permissions tab, select the user account or group for which you want to apply NTFS special access permissions.
2. Click View/Edit to open the Permissions Entry dialog box (see Figure 14.6).




Figure 14.6 The Permissions Entry dialog box

The options in the Permissions Entry dialog box are described in Table 14.5.

Table 14.5 Options in the Permissions Entry Dialog Box

NOTE

---

In the Access Control Settings dialog box, on the Permissions tab, you can view the permissions that are applied to the file or folder, the owner, and where the permissions apply. When special access permissions have been assigned, Windows 2000 displays Special under Permissions.

Taking Ownership of a File or Folder

To take ownership of a file or folder, the user or a group member with Take Ownership permission must explicitly take ownership of the file or folder, as follows:

1. In the Access Control Settings dialog box, on the Owner tab, in the Change Owner To list, select your name.
2. Select the Replace Owner On Subcontainers And Objects check box to take ownership of all subfolders and files that are contained within the folder.

In this lesson, you learned that there are 13 special access permissions, and two of them are especially useful: Change Permissions and Take Ownership. You can give administrators and other users the ability to change permissions for a file or folder without giving them the Full Control permission over the file or folder. This prevents the administrator or user from deleting or writing to the file or folder, but it allows them to assign permissions to the file or folder.

You also learned that you can transfer ownership of files and folders from one user account or group to another user account or group. The current owner or any user with Full Control permission can assign the Full Control standard permission or the Take Ownership special access permission to another user account or group, allowing the user account or a member of the group to take ownership. An administrator can take ownership of a folder or file, regardless of assigned permissions. When an administrator takes ownership of a file or folder, the Administrators group becomes the owner, and any member of the Administrators group can change the permissions for the file or folder and assign the Take Ownership permission to another user account or group.