NT Syntax : Permissions and Privileges

NT permissions can be set on Files and Folders with CACLS or XCACLS.

Permissions can be None, Read, Change or Full
Full being the same as Change plus the right to administer e.g. grant additional users rights to read the file.

Permissions can be assigned to individual users or to NT workgroups.

If a user has no rights to the files in a folder the security tab in the GUI will not appear (if you have no rights to even list the file names then you have no rights to list the security attributes either.)

Ownership of a file will override all access permissions - administrators can take ownership of any file. SUBINACL can change ownership from the command line.
Newly created files will be owned by the account used to create them (unless the account is an administrator).

There are 3 types of NT workgroup:

- Local Machine Workgroup
- Local Domain WorkGroup
- Global Domain WorkGroup

With Active Directory in native mode you can add

- Universal Workgroup —visible throughout the entire enterprise. Universal groups may include both other Universal groups, and global groups from any domain in the enterprise.
Universal groups are expensive to use, so limit the number of these groups - use only where it is necessary to create a group that spans one or more domains.

To create Local Users and Local Groups

Control Panel - admin tools - computer management - local users and groups
( not available on a Domain Controller )

or from the command line...
NET localgroup 

To create Global Domain WorkGroups and Local Domain WorkGroups

Control Panel - admin tools - Active directory users and computers - Users

or from the command line...
NET localgroup /domain
NET group /domain

Local Machine workgroups
A Local Machine User can join a Local Machine workgroup.
A Local Domain WorkGroup cannot join a Local Machine workgroup.
A Global Domain WorkGroup can join a Local Machine workgroup.

Local Domain workgroups
A Domain User can join a Global Domain Workgroup.
A Global Domain WorkGroup can join a Local Domain workgroup.
A Local Domain WorkGroup cannot join another Local Domain WorkGroup.

Global Domain Workgroups
A Domain User can join a Global Domain Workgroup.
A Global Domain WorkGroup cannot join another Global Domain Workgroup.

From the above restrictions - a good arrangement is to assign ACLs to a Local Domain workgroup, assign users to a GLOBAL workgroup, and then assign rights by making the GLOBAL workgroup a member of the Local Domain workgroup.

e.g. Files are stored in
\\server1\Purchasing
\\server2\Procurement

Create a Local Domain workgroup LDw_PFiles - give this group CHANGE permissions on both folders.
Create a GLOBAL workgroup GDw_PurchaseTeam - make this workgroup a member of LDw_PFiles

Now if a second Workgroup need access to the same files..
e.g. GDw_Finance - just make this workgroup a member of LDw_PFiles. Note that you don't even have to figure out where any files are at this stage.

Advantages of this arrangement
- Only one workgroup ACL has to be applied to the files - this improves performance.
- You can see all permissions in Active Directory without having to search through millions of file ACLs - this makes auditing easier.

Disadvantages
- Local Domain Workgroups are only visible within that domain
- Local Domain Workgroups contain the domain name - so require slightly more storage in the SAM database.

See also

WorkGroups - Built-In Users and Security Groups
Workgroups.ppt - The default Admin Workgroups