2

I have an external NTFS-formatted hard disk for my Win 7 PC. For this disk the group Admins of PC1 has full rights. I connected this hard disk with another Win 7 machine and I was surprised, that on that machine I had access to all the files too. I thought different machine different accounts, but that was wrong.

Then I became curious and changed the permissions only to one specific admin Account on PC1, connected it again to PC2 and voilà the expected result happened: I could not access the files.

Now I'm still wondering why in the first test when permissions where given to the group of admins on PC1, why it was possible to access on PC2?

In the internet I read that when you give permissions to the "standard groups" like admins, users, authenticated users, Than those files can be accessed on every machine, since the SID of these groups is on every Win 7 computer in the world the same.

Is that true?

  • 1
    Welcome to Superuser. This is a good first question – nixda May 29 '14 at 12:54
  • thank you nixda.. I just saw that the automatically suggested flags are not attached automatically - i have to choose them right? Since "Win7" and "permissions" were good ones – user54512 May 29 '14 at 13:05
  • I guess with flags you actually mean tags. You could always edit your question and add them later. – nixda May 29 '14 at 13:08
  • Oh yeah i meant tags and yes indeed i could change them afterwards, thx – user54512 May 29 '14 at 13:22
1

Yes, and thank goodness for it, if you ever move media from one system to another. filesystem permissions are designed to only pertain to a specific system (a single PC, a windows domain, etc). but if that system is unavailable, so too is the data.

if windows did not use global GIDs, then you would have to manually take ownership and alter permissions on each file you wished to access, everytime you move them from one system to another, and why else would anyone carry a flash drive?

Remember, with disks, the old sysadmins adage stands; Physical Access == Root Access. Period.

if a person has a hold of a disk, the only possible means to keep them from exerting full control over the data on it is via encryption. Everything else can be easily circumvented. Even if you did lock down your files to your admin, I, possessing your disk, could easily take ownership of the objects and provide myself whatever privileges I required.

  • Forgive me, but what are GIDs? You mean SIDs? I only know group IDs in unix systems – nixda May 29 '14 at 13:11
  • Thinking about this, was a shock for me. So i have a network at home, i give file permissions to the group admin. Network permission is the defeault windows value of "everyone" (i'm not english so maybe bad translation). Yahh ya don't have to worry about everyone - the file permissions do the trick. Now i walk in an hotel use their wlan, now everybody has access to my files? – user54512 May 29 '14 at 13:35
  • only if you share them, over some kind of protocol like netbios. in the situation you describe, the accounts are a workgroup model, so someone would have to sign on to YOUR computer (with the drive attached) as a member of the admin group to access the files. if they had physical access to the disk, they could access everything, but since the files are hosted on your system, and exclusive to your admin group, other residents would not be able to access the files. remember file sharing permissions stack atop fs permissions, so you still need to be an admin on the host to access them. – Frank Thomas May 29 '14 at 13:58
  • as an aside, MS recommends that you always leave share permissions as Everyone Full control. This is because, when you backup a filesystem, permissions are preserved, but if you rebuild your host, all the share permissions are lost. In order to access a file you must be allowed both by the share permissions AND by the filesystem permissions, so this is not a security weakness the way it was back when sharing users were invented, to support FAT filesystems that did now allow file system permissions at all. now that we have NTFS, share permissions aren't very useful anymore. – Frank Thomas May 29 '14 at 14:02
  • Hi Frank, really thanks for your answers. Could you give me an example of when or what would be using Netbios or how Netbios would lead to a scenario that someone could gain access to my files? Sounds like an outdated NetworkProtocoll. And the others would not see my computer in the hotel if i use as network type "public" or? You were talking about if i chose "home network" or "work network" or? Again thx but some of the network stuff is still unclear to me so i will make a new Thread.. – user54512 May 29 '14 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.