Users, Permissions and Access Control

User accounts

A user account is the identity an operating system uses to authenticate a person or service and to decide what it may do, with its own name, credentials, profile folder and group memberships. Every process runs as some account, and the permissions of that account are the limits of what the process can touch. That is why accounts matter even on a single-user laptop: malware started by a user can do exactly what that user's account can do, and no more.

Local, Microsoft and domain accounts

Windows knows three kinds of accounts to sign in with:

• A local account exists only on one computer; its name and password hash are stored on that PC. Nothing syncs, and a forgotten password cannot be reset online.
• A Microsoft account is an online identity (an email address) used to sign in. It syncs settings between PCs, connects OneDrive and the Microsoft Store, allows online password reset, and stores the BitLocker or device encryption recovery key. At the time of writing, Windows 11 Home and Pro setup for personal use expects a Microsoft account and an internet connection.
• A domain account lives in Active Directory (AD), the directory service of an organization, and is checked by a domain controller. One account works on every domain-joined PC, and administrators manage it centrally, including with Group Policy. Sign-in names look like CORP\ana or ana@corp.example.com. Joining a domain requires the Pro, Enterprise or Education edition, not Home. Cloud-managed organizations use Microsoft Entra ID (formerly Azure AD) work accounts in a similar role.

Standard users and administrators

A standard user can run programs, change their own settings and work with their own files, but cannot install software for everyone, change system-wide settings, or read other users' files. An administrator account is an account that is a member of the local Administrators group and can therefore change anything on the computer: install software and drivers, change system settings, manage other accounts and take ownership of any file. Change an account's type in Settings › Accounts › Other users.

Windows also has two built-in accounts, both disabled by default:

• The built-in Administrator account. By default it is not subject to User Account Control (UAC), so everything it starts runs with full rights, and attackers know its name. Keep it disabled and use named administrator accounts instead.
• The Guest account, for anonymous temporary use. It stays disabled; give visitors a standard account or, better, no access at all.

root and sudo on Linux and macOS

On Linux and macOS the root user is the superuser account with user ID 0, which bypasses all file permission checks and can change anything on the system. Working as root all the time is as risky as working as the built-in Administrator: one typo in a command removes system files without a warning.

So administrators work as ordinary users and put sudo in front of the commands that need root rights. sudo asks for the user's own password, checks that the user is allowed (members of the sudo group on Debian and Ubuntu, wheel on Fedora and Red Hat, admin on macOS), and logs every command. On macOS the root account is disabled by default; administrators use sudo. How sudo is set up is covered on Linux at a Glance.

sudo apt update          # one command as root (Debian/Ubuntu)
id                       # who am I, and in which groups?

Groups

A security group is a named collection of user accounts (and sometimes other groups or computers) to which permissions and rights are assigned, so that every member receives them. Permissions go to groups rather than to individual users because people change jobs, and groups do not. When Ana moves from Finance to HR, an administrator removes her from the Finance group and adds her to HR; there is no need to find every folder where Ana was named personally.

Groups a technician meets on every Windows PC:

Local groups are managed in Local Users and Groups (lusrmgr.msc, not available in Windows Home) or with net localgroup; domain groups in Active Directory. On Linux, groups lists a user's groups and sudo usermod -aG finance ana adds Ana to a group.

User Account Control and least privilege

User Account Control (UAC) is the Windows feature that runs programs with standard-user rights even for administrators, and asks for approval before a program gets full administrator rights (elevation). When an administrator signs in, Windows creates two access tokens: a filtered one with standard rights, used for everything by default, and a full one, used only after an elevation is approved. So a malicious web page or macro running in the user's session does not automatically get administrator rights.

The prompt that appears depends on who is signed in:

• Consent prompt for administrators: "Do you want to allow this app to make changes to your device?" with Yes and No. Check the program name and the publisher: "Verified publisher" with a known name, or "Publisher: Unknown", which deserves suspicion.
• Credential prompt for standard users: the same question, but it needs the name and password of an administrator account. That is how a technician installs software on a standard user's PC without changing the user's rights.

The prompt normally appears on the secure desktop (the screen dims), which other programs cannot read or click on. The UAC slider (search "UAC" or Change User Account Control settings) has four levels; the default is "Notify me only when apps try to make changes to my computer".

The principle of least privilege

The principle of least privilege says that every account, person and program should have only the rights it needs for its task, and no more. In practice:

• Users work with standard accounts, not as administrators.
• Technicians use a separate administrator account for admin tasks, and their normal account for email and browsing.
• Services run under dedicated accounts with only the rights they need.
• Access to a folder is given to the groups that need it, with the lowest permission that works (Read instead of Modify).

Least privilege limits the damage when something goes wrong: a phishing attachment opened by a standard user cannot install a driver or switch off the antivirus. It is a cornerstone of the Security topic.

NTFS permissions

NTFS permissions are the access rules stored with every file and folder on an NTFS (New Technology File System) volume, as a list of entries that allow or deny specific users and groups actions such as reading, writing or deleting. They apply whether the file is used locally or over the network. They are set on the Security tab of a file's or folder's Properties. The six standard permissions:

Behind these standard permissions are about a dozen detailed special permissions, visible under Advanced. Every file also has an owner, usually the account that created it; the owner can always change its permissions, and an administrator can take ownership to regain access to a file nobody can open.

How permissions combine: allow and deny

Each permission entry is either Allow or Deny. The rules:

• Permissions add up. A user who is in Staff (Read) and in Finance (Modify) gets Modify: the union of all Allow entries of the user and all their groups.
• Deny beats Allow at the same level. If one explicit entry allows Write and another explicit entry denies it, Write is denied.
• Explicit beats inherited. Windows checks entries in this order: explicit Deny, explicit Allow, inherited Deny, inherited Allow. So an Allow set directly on a folder overrides a Deny that the folder inherits from its parent.

Deny entries make permissions hard to understand, so use them sparingly. Most of the time, simply not granting a permission is enough: without any Allow, access is refused anyway.

Inheritance

Permission inheritance is the mechanism by which new files and subfolders automatically receive the permission entries of the folder they are created in, so that permissions only have to be set once, at the top of a folder tree. Inherited entries are shown grayed out on the Security tab and cannot be changed there; you change them on the parent. With Advanced › Disable inheritance a folder stops inheriting, and Windows asks whether to convert the inherited entries into explicit ones or remove them.

Copying and moving files

What happens to permissions when files are copied or moved is a classic source of "but I set the permissions correctly" tickets. The rules follow from one idea: copying creates a new file, and a move within the same volume does not.

So a confidential file moved from D:\HR to D:\Public keeps its restrictive permissions, and people with access to Public still cannot open it; a file copied there becomes readable by everyone who can read Public. To keep the original permissions while copying, use robocopy with /SEC (or /COPYALL, from an elevated prompt), see Windows Command Line.

Share permissions

Share permissions are the permissions set on a shared folder that control what users connecting over the network may do: Full Control, Change or Read. They apply only to access through the share (such as \\fileserver\finance), never to someone signed in at the computer itself. Set them in the folder's Properties › Sharing › Advanced Sharing › Permissions.

When a user reaches an NTFS folder through a share, both sets of permissions are checked, each combined across the user's groups, and the most restrictive of the two applies:

• Share Read + NTFS Modify: over the network the user can only read. At the computer itself, only NTFS counts, so there the user can modify.
• Share Full Control + NTFS Read: over the network the user can only read.

Because two layers are hard to reason about, a common practice is to set the share permission generously (Authenticated Users: Change or Full Control) and do all real access control with NTFS permissions, which also protect local access. A new share gives Everyone Read by default.

Linux file permissions

Linux (and macOS underneath) uses a simpler model. Every file and folder has one owner and one group, and three sets of three permissions: for the user (owner), the group, and all others. ls -l shows them:

ls -l /srv/finance

-rw-r----- 1 ana finance 58300 Oct  1 09:14 budget.ods
drwxr-x--- 2 ana finance  4096 Oct  1 09:10 reports

The first character is the type (- file, d directory), then rwx for the user, group and others. For budget.ods: Ana may read and write, the finance group may read, others get nothing. The letters mean slightly different things for files and folders:

Octal notation

Each set of three bits is one octal digit: add 4 for r, 2 for w and 1 for x. So rw-r----- is 6, 4, 0: mode 640. The conversion both ways:

def to_rwx(mode):
    """Octal mode such as 0o754 -> 'rwxr-xr--'."""
    result = ""
    for shift in (6, 3, 0):                 # user, group, others
        digit = (mode >> shift) & 0b111
        result += "r" if digit & 4 else "-"
        result += "w" if digit & 2 else "-"
        result += "x" if digit & 1 else "-"
    return result

def to_octal(rwx):
    """'rw-r-----' -> 0o640."""
    mode = 0
    for char, bit in zip(rwx, [256, 128, 64, 32, 16, 8, 4, 2, 1]):
        if char != "-":
            mode += bit
    return mode

for mode in (0o755, 0o644, 0o640, 0o700):
    print(f"{mode:o} -> {to_rwx(mode)}")
for text in ("rwxr-x---", "rw-rw-r--"):
    print(f"{text} -> {to_octal(text):o}")

755 -> rwxr-xr-x
644 -> rw-r--r--
640 -> rw-r-----
700 -> rwx------
rwxr-x--- -> 750
rw-rw-r-- -> 664

The common modes are worth recognizing: 755 for programs and folders everyone may use, 644 for ordinary files, 640 or 600 for files with sensitive data, 700 for a private folder.

chmod and chown

chmod 640 budget.ods                  # set all bits at once (octal)
chmod u+x backup.sh                   # add execute for the owner
chmod g-w,o= reports                  # group loses write, others get nothing
sudo chown ana:finance budget.ods     # new owner and group

chmod (change mode) takes an octal mode or symbolic changes (u, g, o, a for all; +, -, =). Only the owner or root can change a file's mode; changing the owner with chown requires root. Add -R to apply a change to a whole folder tree.

Checking and using your rights on Windows

whoami /groups shows the groups in the current access token. In a normal (non-elevated) Command Prompt of an administrator, the Administrators group is present but marked "Group used for deny only", and the integrity level is Medium: that is UAC's filtered token at work (illustrative, shortened):

whoami /groups

GROUP INFORMATION
-----------------

Group Name                             Type             SID          Attributes
====================================== ================ ============ ==================================================
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                 Alias            S-1-5-32-544 Group used for deny only
BUILTIN\Users                          Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label            S-1-16-8192

Run the same command in an elevated window and Administrators is enabled, with a High Mandatory Level. To open an elevated window, right-click the program and choose Run as administrator, or type its name in Start search and press Ctrl+Shift+Enter; the title bar then starts with "Administrator:". Many commands (sfc, diskpart, chkdsk on the system drive) refuse to work without it.

icacls shows a folder's NTFS permissions on the command line. (I) marks inherited entries, (OI)(CI) means the entry is passed on to files and subfolders, and F, M, RX and R are Full control, Modify, Read & execute and Read (illustrative):

icacls D:\Company\Finance

D:\Company\Finance CORP\Finance:(OI)(CI)(M)
                   BUILTIN\Administrators:(I)(OI)(CI)(F)
                   CORP\Staff:(I)(OI)(CI)(R)

Successfully processed 1 files; Failed processing 0 files