Introduction
Course: IS3340 Week: 1 Lab: Using NTFS to Secure Files and Folders Assignment
In this lab you will use NTFS and share permissions to control access to files and folders.

Story
You're part of the IT support team in the New York office of a nationwide travel services company called USA Travel. You have three other offices in Dallas, San Francisco, and Chicago. All the offices have a separate Windows 2003 Active Directory domain. The domain for the New York office, the root domain for the organization, is named usatravel.com. One afternoon you receive a call from Larry Drake, one of the two sales supervisors in your office. He and the other sales supervisor, Marta Vasquez, both have new Windows XP Professional computers, and they've created a few folders structures on both computers to hold important files. They'd like you to come to their desks and set whatever permissions you need to make sure their sales employees have the different levels of access they'll need to the folders. He then proceeds to give you the following information. There are two sales teams. The first team, led by Larry himself, has two members: Cindy Williamson and Lew Ferrell. The second team, led by Marta Vasquez, also has two members: Tammy Dobson and Juanita Dawson. The Sales department also has an administrative assistant named Markie Chung. The network administrator for your office created three security groups (which you later find out are domain local groups) for the Sales department. SalesAdmin has four members: Larry Drake, Marta Vasquez, Markie Chung, and the Administrator account. Sales1 (Larry's direct reports) has two members: Cindy Williamson and Lew Ferrell. Sales2 (Marta's direct reports) also has two members: Tammy Dobson and Juanita Dawson. On Larry's computer, PRO21, he has created two different folder hierarchies. The first parent folder is named Accounts1. In that folder he has two subfolders, Profiles1 and Reports1. He needs you to give all three sales groups access to the Accounts1 folder. He also needs the Sales1 and Sales2 groups to be able to read information in the Profiles1 folder but not make any changes. Additionally, he needs his direct reports to add files to the Reports1 folder but not delete any files in the folder. He does need full control over both folders, as do Marta and Markie.

Marta has a folder on her computer (PRO23) named Expenses. She needs all the sales staff to be able to add and change and delete documents in the Expenses folder. However, there's a document named Budget in the Expenses folder that only she and Larry need to have access to. Markie should not be able to access the Budget document. Finally, nobody outside the Sales department should have any access to any of the folders on PRO21 and PRO23.

Conditions
You have a network with one Windows 2003 domain controller and two Windows XP Professional workstations that are members of the domain.

Notes
The Administrator password is password. As you perform the various steps of the lab, update your lab report. You will send the lab report to your online instructor for evaluation after you quit the lab. Submit the following screenshots to your online instructor for evaluation: 1) A screenshot showing change permissions for Sales 1 and Sales 2 groups. 2) A screenshot showing NTFS permissions for the Reports1 folder. 3) A screenshot showing full control NTFS permissions for Larry Drake and Marta Vasquez. These screenshots map to the evaluation criteria. Therefore, submit all screenshots to get the points assigned to all evaluation criteria.

Diagram

Connecting to your lab
In this module you will be working on the following equipment to carry out the steps defined in each exercise.    DC1 PRO21 PRO23

Each exercise will detail which console you are required to work on to carry out the steps. To start simply click on the named Server from the device list (located on the left hand side of the screen) and click the Power on from the in tools bar. In some cases the devices may power on automatically. During the boot up process an activity indicator will be displayed in the name tab:    Black - Powered Off Orange - Working on your request Green - Ready to access

If the remote console is not displayed automatically in the main window (or popup) click the Connect icon located in the tools bar to start your session. If the remote console does not appear please try the following option:  Switch between the HTML 5 and Java client versions in the tools bar.

In the event this does not resolve your connectivity problems please visit our Help / Support pages for additional resolution options.

Sample Solution
Task Index
Task 1 On PRO21, share the Accounts1 folder and grant the Sales1 and Sales2 groups Change share permissions. Grant the SalesAdmin group Full Control share permissions. Remove Everyone from the access control list. Task 2 On PRO21, stop NTFS permissions inheritance on the Accounts1 folder. Assign the SalesAdmin group Full Control NTFS permissions on the Accounts1 folder, and assign the Sales1 and Sales2 groups the Read and Write NTFS permissions to the Accounts1 folder. Then deny the Sales1 and Sales2 groups Write NTFS permissions to the Profiles1 folder, and verify that Sales1 group has Read and Write NTFS permissions to the Reports1 folder. Deny the Sales2 group Read and Write NTFS permissions on the Reports1 folder. Task 3 On PRO23, share the Expenses folder. Give the Sales1, Sales2, and SalesAdmin groups Full Control share permissions. Remove Everyone from the access control list by preventing permissions inheritance. Give the Sales1 and Sales2 groups Modify NTFS permissions to the Expenses folder. Remove NTFS permissions inheritance from the Budget document. Grant Larry Drake and Marta Vasquez Full Control NTFS permissions to the document.

Task 1 - Granting share permissions
On PRO21, share the Accounts1 folder and grant the Sales1 and Sales2 groups Change share permissions. Grant the SalesAdmin group Full Control share permissions. Remove Everyone from the access control list. Hint: You assign share permissions to a file or folder using the Sharing tab in the file's or folder's Properties dialog box.

Step 1: Log on to PRO21 and open Windows Explorer.
Action: 1) Log on to PRO21 as Administrator with a password of password 2) Open Windows Explorer. Result: You're logged on to PRO21 and Windows Explorer is open.

Step 2: Share the Accounts1 folder.
Action: 1) In Windows Explorer, expand My Computer in Folder pane and select the C drive, right-click on the Accounts1 folder and choose Sharing and Security. 2) Select Share This Folder and use the default Share name. Click Apply. Result: The Accounts1 folder is shared with the default share name Accounts1.

Step 3: Assign the Sales1 and Sales2 groups Change share permissions, assign the SalesAdmin group Full Control share permissions, and remove Everyone from the access control list.
Action: 1) In the Accounts1 Properties dialog box, on the Sharing tab, click Permissions. 2) Click Add and then Advanced tabs. Click the Find Now button and scroll through the results to find the Domain Admins, SalesAdmin, Sales1, and Sales2 groups. Click on the groups and select OK to add them one at a time. Click OK once they have been added to the objects name box. Click OK.

3) Select SalesAdmin and Domain Admins in the Name list, and in the Allow Column, check Full Control. 4) Select the Sales1 group, and in the Allow column, check Change. Then select the Sales2 group, and in the Allow column, check Change. 5) Select Everyone in the Name list and click Remove. 6) Take a screenshot to show that Sales1 and Sales2 have change share permissions to the Accounts1 folder. 7) Click OK to close the Permissions For Accounts1 dialog box. Result: The Sales1 and Sales2 have Change share permissions to the Accounts1 folder. The SalesAdmin group has Full Control share permissions to the Accounts1 folder, and the group Everyone has been removed from the access control list.

Task 2 - Stop NTFS permissions inheritance
On PRO21, stop NTFS permissions inheritance on the Accounts1 folder. Assign the SalesAdmin group Full Control NTFS permissions on the Accounts1 folder, and assign the Sales1 and Sales2 groups the Read and Write NTFS permissions to the Accounts1 folder. Then deny the Sales1 and Sales2 groups Write NTFS permissions to the Profiles1 folder, and verify that Sales1 group has Read and Write NTFS permissions to the Reports1 folder. Deny the Sales2 group Read and Write NTFS permissions on the Reports1 folder. Hint: A file or folder on an NTFS volume inherits permissions from its parent object: either another folder or the volume itself if the folder is at the volume's root. You can use permissions inheritance to simplify NTFS permissions assignments, but be careful that files and folders aren't inheriting the wrong NTFS permissions.

Step 1: Stop NTFS permissions inheritance on the Accounts1 folder. Action:
1) In the Accounts1 Properties dialog box, select the Security tab. At the bottom of the Security page click Advance. 2) In the Advanced security dialogue box uncheck Inherit parent the permission entries that apply to child objects. Click the Remove option the security dialogue box. 3) Click OK to return to the Security tab. Result: The Accounts1 folder is no longer inheriting NTFS permissions from the C drive.

Step 2: Assign the SalesAdmin group Full Control NTFS permissions and the Sales1 and Sales2 groups Read and Write permissions to the Accounts1 folder.
Action: 1) On the Security page, click Add and then Advanced tabs. Click the Find Now button and scroll through the results to find the Domain Admins, SalesAdmin, Sales1, and Sales2 groups. 2) Click on the groups and select OK to add them one at a time. Click OK once they have been added to the objects name. 3) Select the Domain Admins and SalesAdmin group in the Name list, and in the Allow column, check Full Control.

4) Select the Sales1 group, in the Allow column, uncheck Read & Execute and List Folder Contents. In the Allow column, check Write. Apply the same permissions to the Sales2 group. When you're done, click OK. Result: The SalesAdmin group has Full Control NTFS permissions on the Accounts1 folder. The Sales1 and Sales2 groups have Read and Write NTFS permissions on the Accounts1 folder. The Profiles1 and Reports1 folders inside the Accounts1 folder inherit these NTFS permissions.

Step 3: Deny the Sales1 and Sales2 groups Write NTFS permissions to the Profiles1 folder, and verify that Sales1 group has Read and Write NTFS permissions to the Reports1 folder. Deny the Sales2 group Read and Write NTFS permissions on the Reports1 folder.
Action: 1) In the Accounts1 folder, right-click on the Profiles1 folder and choose Properties. Select the Security tab. Verify that the Profiles1 folder is inheriting NTFS permissions from the Accounts1 folder. Select the Sales1 group, and in the Deny column, check Write. Do the same thing for the Sales2 group. 2) Select the SalesAdmin group and verify that the group has Full Control NTFS permissions. Click OK. Click Yes to close the Security message box. 3) In the Accounts1 folder, right-click on the Reports1 folder and choose Properties. Select the Security tab. Verify that the SalesAdmin group has Full Control and the Sales1 group has Read and Write NTFS permissions. Take a screenshot showing NTFS permissions for the Reports1 folder. 3) Select the Sales2 group, and in the Deny column, check Read and Write. Click OK and click Yes to continue. Result: The SalesAdmin group has full control over the Profiles1 and Reports1 folders. The Sales1 and Sales2 groups have Read NTFS permissions to the Profiles1 folder. The Sales1 group has Read and Write NTFS permissions to the Reports1 folder, however, the Sales2 group cannot access the Reports1 folder.

Task 3 - Modify NTFS permissions
On PRO23, share the Expenses folder. Give the Sales1, Sales2, and SalesAdmin groups Full Control share permissions. Remove Everyone from the access control list by preventing permissions inheritance. Give the Sales1 and Sales2 groups Modify NTFS permissions to the Expenses folder. Remove NTFS permissions inheritance from the Budget document. Grant Larry Drake and Marta Vasquez Full Control NTFS permissions to the document. Hint: Remember, when share and NTFS permissions are combined, the most restrictive of the two sets of permissions applies.

Step 1: On PRO23, share the Expenses folder.
Action: 1) Log on to PRO23 as Administrator with a password of password 2) Open Windows Explorer on the C drive, right-click on the Expenses folder and choose Sharing and Security. 2) Select Share This Folder, and use the default share name. Click Apply. Result: On PRO23, the Expenses folder is shared with the default share name of Expenses.

Step 2: Give Sales1, Sales2, and SalesAdmin Full Control share permissions to the Expenses share.
Action: 1) On the Sharing tab, click Permissions. Add the three sales groups and Domain Admins to the Name list. Give each group full control, and then remove Everyone from the list. Result: The Sales1, Sales2, SalesAdmin and Domain Admins groups have Full Control share permissions to the Expenses share.

Step 3: Give the Sales1 and Sales2 groups Modify NTFS permissions and the SalesAdmin group Full Control NTFS permissions.
Action: 1) In the Expenses Properties dialog box, select the Security tab. At the bottom of the Security page click Advance.

2) In the Advanced security dialogue box uncheck Inherit parent the permission entries that apply to child objects. Click the Remove option the security dialogue box. Click OK. 3) Add the Sales1 and Sales2 groups to the Name list. Give both groups the Modify NTFS permission. Add the SalesAdmin and Domain Admins group and give it Full control. Result: The Expenses folder is not inheriting NTFS permissions from the C drive. The Sales1 and Sales2 groups have Modify NTFS permission on the Expenses folder. The SalesAdmin group has full control.

Step 4: Remove NTFS permissions inheritance from the Budget document. Grant Larry Drake and Marta Vasquez Full Control NTFS permissions to the document.
Action: 1) In the Expenses folder, right-click on the Budget document, choose Properties, and select the Security tab. 2) Uncheck Allow Inheritable Permissions From Parent To Propagate To This Object. Click Remove. 3) Add both Larry Drake's and Marta Vasquez's user accounts to the Name list. Assign them both Full Control permissions. 4) Take a screenshot showing full control NTFS permissions for Larry Drake and Marta Vasquez. Result: Only Larry Drake and Marta Vasquez can open and modify the Budget document in the Expenses folder. Check Results You can check share permissions on any share by right-clicking on the shared folder, choosing Sharing, and clicking Permissions on the Sharing tab. You can check a shared folder's NTFS permissions by selecting the Security tab in the same dialog box. To check the NTFS permissions on any file or folder, right-click the object, choose Properties, and select the Security tab.

You could also experiment with permissions in this lab by logging on to PRO21 as a specific user and seeing if they have the permissions to the Accounts1 share and its subfolders. For example, you could log on as Tammy Dobson, a member of the Sales2 group, and verify that she can read the contents of Profiles1 but not the contents of Reports1.You could log on as the various users in the Sales OU to see if the effects of the share and NTFS permissions are what you expect.

Summary
In this lab, you completed the following tasks: Task 1 - Grant group Full Control share permissions Task 2 - Stop NTFS permissions inheritance Task 3 - Modify NTFS permissions to the Expenses folder