## NTFS ACLs vs. UNIX Permission Bits

Most UNIX systems depend on file and directory permission bits to determine who has what type of access. The basic permissions are read, write, and execute for a specific user, a specific group or other, which includes everyone listed in the password and group files. There are also the setuid and setgid bits for altering the running permissions of an executable. Setting bits on directories carries a special significance unknown to most UNIX users. For example, using the setgid bit on a directory will affect the default group of subdirectories, and the t bit in the other field allows anyone to create files, but allows only the owner to delete his or her own files. UNIX users have to know the context (directory or file) and the UNIX version to correctly interpret the meaning of the bits.

In contrast, Windows NT access control lists (ACLs) allow a more complex but more intuitive security scheme. Users and groups are given specific rights that spell out what kind of actions can be performed. As in UNIX, the rights on a parent directory determine what can be done to subdirectories.

Individual NTFS permissions can be set on folders or files. The actions that a user can take when individual permissions are assigned to a folder or file are described in the following table.

NTFS permission | For a folder—a user can... | For a file—a user can...
Read (R) | Display folder names, attributes, owner, and permissions. | Display file data, attributes, owner, and permissions.
Write (W) | Add files and folders, change folder attributes, and display owner and permissions. | Display owner and permissions, change file attributes, create data in and append data to a file.
Execute (X) | Display folder attributes, make changes to subfolders within a folder, and display owner and permissions. | Display file attributes, owner, and permissions. Run a file if it is an executable.
Delete (D) | Delete a folder. | Delete a file.
Change Permissions (P) | Change a folder permissions. | Change a file permissions.
Take Ownership (O) | Take ownership of a folder. | Take ownership of a file.

Note On an NTFS volume, the person who creates a file or folder becomes the owner. The owner can always assign and change permissions on a file or folder. Some UNIX versions are available with access control list (ACL) features that are comparable to those available in Windows NT.

#### Everyone User

Traditional UNIX file and directory security does not have a mechanism to specifically address users or groups that are unknown to the local security database. As a result, these users are refused access to a file or directory. This becomes a problem when a file system from one computer is accessed over the network by another computer with a different set of users.

Windows NT has an everyone group that can be used to give rights to users unknown to the local Windows NT security database. There are some UNIX file system types, such as AFS, that have a similar mechanism.

#### File System Quotas

Windows NT does not come with a disk quota system as part of the base operating system, but there are several third-party packages available. Quotas will be a feature of Microsoft Windows NT® 5.0.

©1997 Microsoft Corporation. All rights reserved. Legal Notices.
Last Updated: December 1, 1997