Windows NTFS Permissions

Windows access control is default-deny: an access check must find an explicit allow entry or the request is refused. NTFS permissions apply to files and folders on NTFS-formatted volumes and are enforced locally (including over the network when combined with share permissions).

Folder permissions

Permission	What it allows
Read	View and list files and subfolders
Write	Add files and subfolders
Read & Execute	View, list, and execute files; inherited by files and folders
List Folder Contents	View, list, and execute files; inherited by folders only
Modify	Read, write, execute, and delete the folder itself
Full Control	Read, write, change permissions, and delete files and subfolders

File permissions

Permission	What it allows
Read	View the file’s contents
Write	Write to the file
Read & Execute	View contents and execute the file
List Folder Contents	N/A (folder-only)
Modify	Read, write, execute, and delete the file
Full Control	Read, write, change permissions, and delete the file

Comparison with UNIX permissions

The models differ in important ways:

Dimension	Windows NTFS	UNIX (traditional)
Granularity per user/group	Coarser — six preset permission levels	Finer — read/write/execute bits
Granularity across users/groups	No limit — each user or group gets its own ACE	Three sets only (owner, group, other)
Deletion control	Separate “sub-permission” (part of Modify / Full Control)	Determined by write on the parent directory
Permission change	Requires Full Control or explicit “Change permissions” right	Requires ownership
Inheritance	Explicit inheritance model with propagation flags	umask-based, no per-object ACLs without POSIX ACLs

Windows treats deletion and permission changes as distinct sub-permissions that can be granted independently. UNIX has no direct equivalent — the ability to delete depends on the parent directory’s write bit.

In many ways the NTFS model is more expressive than the traditional UNIX model (pre-POSIX ACLs), because it supports arbitrarily many access control entries (ACEs) per object and separates concerns that UNIX conflates.

Security relevance

• Misconfigured permissions are a common privilege escalation vector. Services running as SYSTEM with weak file/folder permissions on their binaries allow replacement with malicious executables. See windows-reconnaissance-commands for how to enumerate these.
• icacls is the built-in command-line tool for inspecting and modifying NTFS permissions (superseded cacls).
• Share permissions and NTFS permissions are both evaluated for network access; the most restrictive result wins.

Sources

• Microsoft Learn — Access Control Overview
• Microsoft Learn — Share and NTFS Permissions

Related: windows-reconnaissance-commands, amsi-bypass