Managing NTFS permissions is critical to securing access to an organization’s confidential files and folders. IT admins often struggle with deciding which permissions to grant to whom, and, in most cases, employees have access to more data than they need. In organizations with large IT environments, admins must deal with thousands of folders, unique permissions, security groups, group memberships, and more.
NTFS Permissions Management
There are a few things admins can avoid in NTFS permissions management that will go a long way in complex environments. More likely than not, admins will experience trouble locating and fixing loopholes in assigned NTFS permissions. Addressing this will require more careful attention to detail and utilizing some best practices.
Related Article: Restoro Offers Advanced Repair Software
Assigning users direct access to folders.
The most common mistake while assigning permissions is granting access permissions directly to a user. This can be a maintenance nightmare for admins if this user is deleted or changes their role, leaving admins to hunt for and remove orphaned SIDs and ACLs.
The best practice is to create the right security group and assign the user to this group. When the user leaves the organization or changes roles, they can be removed from the group and reassigned to another group according to their new role.
Failing to identify broken NTFS permissions.
When NTFS permissions are broken, the inheritance of access control will not function correctly. This means that the permissions applied to a parent folder have not propagated down to the child folder, or that the child folder has inherited permissions that are not applied to the parent folder.
Native NTFS permissions management tools make it difficult to identify broken access-control lists (ACLs). This can make it hard for admins to locate and fix them, which can lead to maintenance issues in the future. IT admins need a tool that can identify and fix broken NTFS permissions.
Setting NTFS permissions on a deep folder structure.
Organizations that don’t plan their folder structure properly often have directories with multiple nested folders. Assigning NTFS permissions to these nested folders can cause many problems, like not knowing which security ACLs exist at the subfolder level.
Admins can ensure hidden permissions are not an issue by limiting the number of sub folders on which NTFS permissions can be set, and by keeping track of permissions each layer of the sub folder inherits. Although it is possible to deny permissions explicitly at the folder level, it is usually best to have a minimalistic hierarchy for permissions management.
The biggest challenge for AD administrators is finding a tool that can quickly and easily identify and resolve NTFS permission issues without the need for complex PowerShell scripts. AD Manager Plus has been consistently voted as one of the top tools for NTFS permissions reporting and management.
Hello, My name is Shari & I am a writer for the ‘Outlook AppIns’ blog. I’m a CSIT graduate & I’ve been working in the IT industry for 3 years.