Hard Links and Permissions / ACLs

Windows Internals
Published May 14, 2009

Commenter Lee asked how ACLs are evaluated when an object has multiple hard links. I replied with comments of my own, which turned out to be wrong after I did some experiments. Here is what I found out about hard link permissions and believe to be true.

Can permissions on multiple hard links to the same data be different?

No. Permissions on all hard links to the same data on disk are always identical. The same applies to attributes. That means if you change the permissions/owner/attributes on one hard link, you will immediately see the changes on all other hard links.

Which permissions on the link target are required to create a hard link?

Only the permission “write attributes” (for programmers: FILE_WRITE_ATTRIBUTES) is needed on the target. Whether or not you are the owner of the target is not relevant.

These topics do not seem to be documented anywhere. So how did I find out? I tried it out (on Windows 7 RC).

Attribute DACL Hard Link Owner Permissions SACL

Comments

Comments are powered by Giscus. Please enable JavaScript to view them, or view discussions directly on GitHub.

Related Posts

Hard Links, Soft (Symbolic) Links and Junctions in NTFS: What Are They (For)?

This is an attempt at demystification. In the Windows world, links in the file system are often regarded as obscure, except for the infamous .LNK files, of course. But file system links are neither freaky UNIX/Linux command line stuff, nor are they new: Microsoft’s OS offers two types of links since Windows 2000 and a third type since Vista/Server 2008. And boy, can they come in handy!

Windows Internals

Q&A: How to Modify Permissions on Administrative Shares

Question by reader Kendra: I stumbled upon your blog/profile while I was looking for options to lockdown my administrative shares. Maybe you can help me. I’m a Network Administrator for an aerospace / engineering firm where users need administrative access to their PCs. The engineers work on very high-level OS and hardware development and need complete control of their systems. As you can imagine this poses a huge security problems for me at the network level. Currently my users are granted local administrator rights via an AD group (Local Admins) which is added to the local Administrators group on their local PCs. This makes it convenient for my engineers to login to any PC in the company and have local admin rights to do whatever they need to do. This also gives all of my users access to each other’s administrative shares across the network. For example, anyone in this AD group can run \computername\c$ and access any PC on my domain. I do NOT want to disable administrative shares as I am using them to automatically deploy desktop configuration settings (email, mapped network drives, printers, etc). Do you know of a way that I can give my engineers local admin rights without giving them rights to each other’s administrative shares? Any help would be greatly appreciated.

Windows Internals

Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained

Updated: 2021-06-22 Every object that can have a security descriptor (SD) is a securable object that may be protected by permissions. All named and several unnamed Windows objects are securable and can have SDs, although this is not widely known. There does not even exist a GUI for manipulating the SDs of many object types! Have you ever tried to kill a system process in Task Manager and got the message “Access denied”? This is due to the fact that this process’ SD does not allow even administrators to kill the process. But it is, of course, possible, as an administrator, to obtain the necessary permissions, provided a GUI or some other tool is available.

Windows Internals

How to Prevent Users from Changing Permissions on File Servers

On file servers in corporate environments one typically does not want users to change permissions, even on their own files. It might seem that it would be sufficient to simply grant change permissions instead of full control, but unfortunately that is not the case. The problem is that whenever a new file gets created, the user creating the file will be its owner. And owners can always change permissions, regardless of the contents of the DACL.

Latest Posts

Mitsubishi Heat Pump Data in Home Assistant via Modbus

Mitsubishi Heat Pump Data in Home Assistant via Modbus

This article shows how to get detailed information about your Mitsubishi heat pump’s status and operations into Home Assistant. Prerequisites You’ll need a Mitsubishi Modbus interface, either the older A1M (serial Modbus/RTU via RS-485 only) or the newer A1M+ (Modbus/TCP via Ethernet in addition to Modbux/RTU). I’m using the Ethernet variant.

Home Automation, Networking & Self-Hosting

GitHub: Authenticated Access via SSH

GitHub: Authenticated Access via SSH

This article describes how to set up authenticated access to a (private or public) GitHub repository from Linux. Create & Set Up an SSH Key SSH Key Creation Create a new SSH key:

Software development

Fixing IPv6 Intermittent Packet Loss Caused by Windows Firewall

Fixing IPv6 Intermittent Packet Loss Caused by Windows Firewall

This article shows a simple solution to a weird networking problem that plagued me for hours: IPv6 packets were sometimes lost; IPv4 was not affected. Problem: IPv6 Ping Timeouts and Packet Losses Symptom: Teams Issues I noticed the problem first when there were intermittent connectivity issues in Teams during a meeting.

Fixing VS Code UI Unresponsiveness Caused by GitHub Copilot Extension

Fixing VS Code UI Unresponsiveness Caused by GitHub Copilot Extension

This article shows a simple solution to a problem that doesn’t seem to be adequately documented: VS Code UI lags, freezes, and delays caused by the GitHub Copilot extension. Problem: VS Code UI Becoming Slow Having worked on a Python project for a while, I noticed that VS Code’s UI was frequently freezing for seconds at a time. This was happening in various places of the UI: the editor itself but also in the GitHub Copilot Chat window. Copilot also seemed to be taking more and more time getting ready to answer, and the extension-host process would fully saturate one CPU core for long periods of time.