Navigating the File System Permission Jungle

Windows controls how users access files and folders through a detailed and complex system of permissions. In fact, Windows has one of the most granular object-access control mechanisms of any popular OS. Files and folders have at least 14 NTFS permissions that can be allowed or denied—and audited. You can set these permissions on a per file or folder and per user or group basis. You can also set permission inheritance on a per file or folder and per user or group basis. It's easy to get bogged down in a quagmire of permissions complexity. Here's a quick guide to how Windows file and folder permissions work and how to use them more effectively.

Object Access Basics
A user never directly "touches" any Windows object. All object access is done through programs (e.g., Windows Explorer, Microsoft Office) or processes. A program accessing a local resource on behalf of the user is called impersonation . A program accessing a remote resource is called delegation. . . .