Hey everybody.
Welcome to going a little deeper part two.
So in this video we're going to be going over the basic permissions on a Windows machine.
In this particular case we're going to start off with users and groups.
So I just want to do a brief
conversation around users and groups so we're gonna go over here get a computer management users and
groups.
The first thing I want to do we've already seen the users where we see the administrator administrator
default account and.
Right.
So we want to take a look at groups.
This would give us a better idea of what each one does.
So administrators has full access to the Machine backup operators are restricted backing up functions
and restoring files as an example.
Power users for backward compatibility for limited administrative access remote desktop users as well
standard users.
So whether or not they're just standard plain old access understanding what some of these do is important
because there may be organizations that put a lot of users in remote desktop or maybe they're part of
the backup operators which does give you some more rights than you would have as a standard user hyper
v administrators as an example you can now if you have full control over the hyper v instances that
are running on the system.
So keep keeping an eye on these.
Now you can add your own custom group if you wanted to.
So test group and then for the members or to say Mr. Right.
OK.
And great.
So now we've got a group in here called test group and it has the administrator has an option or as
a user.
So we're gonna go and delete this because we're not gonna need it.
Anne-Marie click over to users again and wish an easy way to create a user.
So we'll do
the name I'll give a
random password.
We do not want to do that and I will just say good expire.
So we got the user it.
Right now this user if we take a look at its properties is not a member of anything but the standard
user.
So to make Brandon an administrator we would go into here and type administrators.
So we're looking for the groups in this particular case.
Okay.
And apply now Brandon is now an administrator to remove that just as quick quick and apply some quick
rules.
So General so we can make sure we said a few things we can make sure the account is disabled we can
change the password.
Our this is their profile.
So if you need them to log in if you want to store their profiles in the different information other
than
right here at the U.S. voters eat and store it.
And other places bring that back up
where you go.
Yes.
All right let's just go real.
Produce go.
So you could set the path and you can set a log in scripts or a bad script which is a scripting language
and windows you can have it set to run anything you want really.
Its home folder you can even have a connect to a network drive a lot of this is managed by Active Directory
normally but if you're on a centralized system you can do it from here.
You can set certain things to start up on start for remote desktop services.
You can manage how they handle their sessions.
Remote control remote remote desktop services profile.
You can browse some of this stuff at your leisure just understand that a lot of this stuff is handled
by group policies which will go over in the Active Directory mini module so for the brand and user will
leave him as a standard user for now.
OK.
So now we've got users and groups you know how to add them to a system.
So this is done you can do the same thing in the desktop version.
This just happens to be the window the server version.
So we're gonna go in and close out here.
Now what I want to talk to you guys about is the actual permissions themselves.
So let's create a folder called test.
So if we notice inside test we can put whatever information we want in there save it
just so you guys know if you have it figured it out already.
If you're on a Mac Windows key or the command key s pulls up different stuff.
So you'll have to do the control C but if we open this back up we see this here.
Right.
So
you've got to wrap it.
So we'll go ahead and save close again so we can still have access to it if we need to rename the file
we can do so.
So if we go to properties under security we will see our basic level of permissions.
So if we see here system so in Windows think of system as the highest level of privilege you can have
similar to how on an on Linux systems it's root.
So there's an administrator which can do most things if not all and there's things that only system
can do.
Now you can get system access from administrator without any issues but there is that extra level of
protection because there's things that system does that administrator would never need to.
And then we have administrators which is the group that we were working with before.
So we're gonna look administrator.
So this is the account that I'm currently logged into right now.
So we can see I have full control we have full control which allow which enables the modify read and
write and read and execute read and write.
So we're going to go ahead and edit this.
So if we go to administrator let's say I want to disable I want to still be able to read but I don't
want to be able to modify it.
I'm sorry.
That's not what I'm looking for.
We're looking for the right only.
So I don't want to be able to write to it.
So modify as modifying the file as far as like permissions and renaming it and writing is actually writing
the content to it.
So if we go ahead and deny myself the right option just say you know deny it takes precedence over everything.
Go ahead click.
Yes.
OK.
OK let's try to rename it
we can rename it perfect so let's go ahead and try to open it.
So we still have read Acts or write acts or read access so let's add in a little bit here.
Let me try to save it so now you can see it's popping up to have a save it in a different location.
Which means we can not save it here.
So if we go back into our permissions here security edit administrator we're going to reduce ourself
to not being able to read go ahead and do that.
So again we can still
rename it but if we try to read it we get access tonight.
But what's interesting about this is we can delete it as well.
I just want to show you one other thing.
So if we wanted to add a user here to have access to this let's say we wanted brand to have access to
just this particular file we come into here we could add type and brand and check names it will auto
fill in the name click OK and we'll allow brand and we'll just say read access for now and we'll deny
everything on Mac we deny everything else so we'll just do read.
Perfect.
So now Brandon just has read access to this.
So if we were to log in as Brandon we would just be able to read it.
We couldn't modify it etc. However you can see we still had no right access to it or no read access
to it but we can delete it.
Now we're going to work with the folder now just to test again.
So with folders and in windows in general there are two levels of permissions that you need to be aware
of.
There are shared permissions in NTFS permissions.
So we've already talked about what NTFS is but so shared permissions only taken effect when a user is
remotely trying to access the file or folder.
So if they're trying to go over remote desktop if they're trying to hook up to a network share and access
a particular file or folder that is where sharing permissions come into place NTFS permissions are stuff
local to the machine.
So when somebody tries to access something locally in NTFS as what we were playing with right here.
So this is NTFS permissions now sharing permissions is different.
So if we go to sharing we'll go ahead and share this folder and we will go ahead and check the permissions
right now and everybody has read access.
So this does not mean that everybody on the system has read access.
However there's a few ways to go around it.
If you have local access to machine you can log in physically you can't view the file but if you still
have remote access you could now view the file.
So there's there's a lot of overlap and there's this is why Windows permissions can get very bad very
quickly.
So there's a lot of administrators that will miss miss set these up or miss configure them or have things
such as that where you have everybody's got permission to file from the outside but they didn't lock
down who can remote into the machine through some sort of policy so anybody can remote in as long as
they have a local user account.
But it was supposed to be only administrators that remote in but the this individual might have already
had access they might already have access to the machine which is perfectly fine for locally which the
NTFS permissions are then taken to place and they don't have access to the file but if they remote desktop
in from the outside it will let them be the file just like normal.
So that's where issues like this can happen.
So again with everybody if we wanted to just give brand in full control from the outside we'll give
him full control and we will deny we can't deny everybody that would cause a problem.
So we'll just keep the read well we'll deny that change.
I'm sorry.
Well we'll keep it read.
So Brandon has full control everyone just as we will go ahead and fly and go.
So now with this particular file Brandon has no NTFS permission so he is not able to if he logs into
this machine just like normal and tries to access this folder it would fail.
However because of the sharing settings Brandon can remote desktop in or hook to the network shared
directly and be able to have full access to this file.
There is one other place for this is which is the advance settings.
So it's very similar to what we saw before so we can see here.
This applies to all forms files and sub files and folders full control again.
We can view this as well as US systems in this particular case can you.
The administrators
and we also have the sharing settings here so we can see the sharing settings right.
Go ahead and click this.
I'm sorry that's changing the order.
We don't do that.
There's a few options in here so you can see that the permissions on on this particular folder every
every sub folder in file under that folder that we created will have inherit the same permissions.
But in some cases you may want permissions on the folder but lesser restrictions on the files inside.
But doing it with inheritance you can't do that.
So if we disable inheritance yes we want to remove all inheritance.
Now we need to set up our permissions directly so we would allow.
We'd have to allow administrators to have access.
But I don't want to necessarily do that.
So we're going to go out here and keep the permissions that we have.
So I want you to keep in mind that permissions between shared in NTFS are different.
Shared is external only coming in and NTFS is local.
If one allows but the other disallows it's not going to matter as long as the user can access from both
ends whether it's externally or physically on the machine they'll be able to have access in one way
shape or form.
So it's good to keep things in sync.
However that's where a lot of administrators have issues around that is because of the fact that it
can get very sticky very quickly.
So there's a lot of a lot of permissions that could go on if you're and if your enterprise has 15 20
thousand employees.
So permissions can get really bad really quickly and a lot of it should be managed from some sort of
configuration management tool.
However in smaller instances where a company might only have one hundred two hundred employees this
is still done manually and that's where you're going to find a lot of your issues.
And even in large organizations having permission issues is fairly common.
I tend to find it quite quite a bit.
It's just it's just something you gotta fix it.
It's a whack a mole situation you've got you've got to fix it as you go.
There are cases where you can audit this type of thing but in a general sense it's sometimes the scales
too large to just sit down and audit it.
You might need an entire team for weeks to start auditing all of this and making sure that things when
they cross are correct and where the issues are around there.
So this has been permissions side of things so feel free to play around with permissions inside of the
virtual machine.
You can effectively lock yourself out of out of files.
So like for example for this particular file test if I came in here went to security went to administrator
clicked at it and denied or I'm sorry not system administrator and I denied me that would not that would
disk that would make sure I'm not able to modify or do anything to this file.
It's essentially just going to sit there until I log in or escalate escalators system and then go ahead
and kill the file.
So you need to be careful you can't lock yourself out of files.
There are a few tricks tips and tricks outside of that to get yourself access to the files as long as
you're an administrator but tend to avoid that test run with the permissions with the shared permissions.
See what you can come up with see what the inconsistencies are and go from there.