Permissions Archives • Helge Klein

Samba File Server With Windows ACLs in a Docker Container

This article explains how to set up a Samba file server with Windows ACLs as a domain member in a Docker container.

Finding (Executables in) User-Writeable Directories

This article presents two different detection types for insecure filesystem permissions on Windows endpoints: scanning for directories that are user-writable, and detecting processes that are started from user-writeable directories.

Error Message Explained: User Profile Service Failed the Logon

This article is part of Helge’s Profile Toolkit, a set of posts explaining the knowledge and tools required to tame Windows user profiles. Many errors related to user profiles result in the user getting a temporary profile instead of the regular local or roaming profile. I have written about possible causes for that here. In […]

Windows 7 Default HKCU Registry Permissions

This is a complete listing of all Windows 7 HKEY_CURRENT_USER registry permissions. The list was generated on a 32-bit installation with SetACL. More default permission listings can be found here.

Windows 7 Default File System Permissions Listing

This is a complete listing of all Windows 7 file system permissions. The list was generated on a 32-bit installation with SetACL. More default permission listings can be found here.

Finding and Removing Orphaned SIDs in File Permissions, or: Busting the Ghosts Built Into Windows 7

Due to a lack of visibility permission cleanup is performed far less frequently than it could, and probably should. As a result, ghost ACEs (permissions from deleted accounts) linger in the dark corners of the file system, threatening the unsuspecting admin with the horrors of unresolvable SIDs.

Permissions Windows Does Not Show You

Sometimes it is good not to know the truth, but as an administrator you better know what is going on! Most IT pros know that Explorer lies a lot (on a German system C:\Users magically becomes C:\Benutzer), but few are aware that Windows’ permission handling dialog ACL Editor also tends to “pretty up” things. Example […]

How to Configure a File Server for Hosting User Profiles

This article is part of Helge’s Profile Toolkit, a set of posts explaining the knowledge and tools required to tame Windows user profiles. Setting up a network share on a file server for hosting user profiles is not too difficult if you follow the steps outlined in this article. The recommendations I give here apply […]

Temporary User Profiles

This article is part of Helge’s Profile Toolkit, a set of posts explaining the knowledge and tools required to tame Windows user profiles. Nobody wants a temporary profile. So why do I get one? Here are the most common reasons for Windows to only issue a profile that is deleted at logoff instead of the […]

Helge’s Profile Toolkit

Helge’s Profile Toolkit is a collection of tips, tricks and tools for working with user profiles.

Q&A: How to Modify Permissions on Administrative Shares

Question by reader Kendra: I stumbled upon your blog/profile while I was looking for options to lockdown my administrative shares. Maybe you can help me. I’m a Network Administrator for an aerospace / engineering firm where users need administrative access to their PCs. The engineers work on very high-level OS and hardware development and need […]

How to Map Generic Rights to Standard and Specific Rights

There are two equivalent ways trustees can be assigned a specific set of permissions on Windows: via generic rights and via a combination of standard and specific rights. Generic rights are identical for all object types. There are only four of them: GENERIC_READ (0x80000000) GENERIC_WRITE (0x40000000) GENERIC_EXECUTE (0x20000000) GENERIC_ALL (0x10000000) As the name implies, generic […]

What is the SYNCHRONIZE File Access Right?

When dealing with Windows NTFS file system permissions, one quickly encounters the SYNCHRONIZE access right, the purpose of which may not be obvious. SYNCHRONIZE belongs to the standard access rights, just like DELETE, READ_CONTROL, WRITE_DAC and WRITE_OWNER. Here is the definition of SYNCHRONIZE from MSDN (2010): The SYNCHRONIZE access right is defined within the standard […]

Taking Ownership Fails With UNC Path, Works Locally!?! Why?

Here is an interesting tidbit related to Windows security: Create a test file share, e.g. C:\temp\test, and share it with full permissions for everyone (share, not NTFS permissions) as “test” Create the following directory hierarchy below the share: C:\temp\test\1\2\3\4 Assign ownership of the four folders 1, 2, 3 and 4 to any user (but do […]

How to Modify Default Share Permissions and Other Tweaks

NTFS permissions are stored in the file system, that is well known. But where are share permissions stored? As so often with Windows: in the registry. Network shares are defined by only a handful of relatively simple registry entries stored in the server service’s key which is, for historical reasons that go back way beyond […]

Hard Links and Permissions / ACLs

Commenter Lee asked how ACLs are evaluated when an object has multiple hard links. I replied with comments of my own, which turned out to be wrong after I did some experiments. Here is what I found out about hard link permissions and believe to be true.

Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained

Updated: 2021-06-22 Every object that can have a security descriptor (SD) is a securable object that may be protected by permissions. All named and several unnamed Windows objects are securable and can have SDs, although this is not widely known. There does not even exist a GUI for manipulating the SDs of many object types! […]

How to Prevent Users from Changing Permissions on File Servers

On file servers in corporate environments one typically does not want users to change permissions, even on their own files. It might seem that it would be sufficient to simply grant change permissions instead of full control, but unfortunately that is not the case. The problem is that whenever a new file gets created, the […]

Tag: Permissions

Samba File Server With Windows ACLs in a Docker Container

Finding (Executables in) User-Writeable Directories

Error Message Explained: User Profile Service Failed the Logon

Windows 7 Default HKCU Registry Permissions

Windows 7 Default File System Permissions Listing

Finding and Removing Orphaned SIDs in File Permissions, or: Busting the Ghosts Built Into Windows 7

Permissions Windows Does Not Show You

How to Configure a File Server for Hosting User Profiles

Temporary User Profiles

Helge’s Profile Toolkit

Q&A: How to Modify Permissions on Administrative Shares

How to Map Generic Rights to Standard and Specific Rights

What is the SYNCHRONIZE File Access Right?

Taking Ownership Fails With UNC Path, Works Locally!?! Why?

How to Modify Default Share Permissions and Other Tweaks

Hard Links and Permissions / ACLs

Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained

How to Prevent Users from Changing Permissions on File Servers