Instructor: Analyzing share permissions. 2 2
In this lesson, I'm going to show you how we can analyze 3 3
the share permissions for our different file servers. 4 4
Now to do this, we're first going to go 5 5
into our server manager. 6 6
Once we're in there, we're going to click on manage 7 7
and then add servers. 8 8
Then we're going to type MS 1 and click find now. 9 9
MS 1 is a Windows 2016 server in my lab environment. 10 10
Once I have that, I'm going to click it 11 11
and then hit the right arrow to add it to the right pane 12 12
and then click OK. 13 13
This will add that file server 14 14
into my server manager dashboard. 15 15
Now that it's in my server manager dashboard, 16 16
I can go to file and storage services, 17 17
then click on shares and then click on audit. 18 18
From here, we're going to right click on audit 19 19
and select properties. 20 20
Once we're there, we'll select permissions, 21 21
and this is where we can start looking 22 22
at the permissions for those shares. 23 23
Now, as you can see here, 24 24
the sec-glo-audit group, 25 25
which we added in a previous lesson, 26 26
has permissions of full control, not read only. 27 27
So let's go ahead and change that. 28 28
Next, let's click customize permissions. 29 29
And note here that sec-glo-audit 30 30
has been granted full control 31 31
using NTFS file system permissions. 32 32
These have been applied locally. 33 33
Now, these NTFS file system permissions 34 34
do propagate to child objects underneath 35 35
and to containers as you're seeing here, 36 36
or they can also be set separately. 37 37
Now, if we go and click on the share tab, 38 38
we can also look at the permissions for that share drive. 39 39
These are simple share permissions. 40 40
Here it allows for full control to authenticated users. 41 41
This permission is going to apply to anyone 42 42
who accesses this share drive over the network, 43 43
whereas the NTFS permissions are when anybody accesses 44 44
that domain controller locally. 45 45
That's the difference. 46 46
Now, it is considered a standard practice 47 47
in Windows Administration 48 48
to allow very permissible share permissions 49 49
over the network, such as full control here, 50 50
and then more constrictive or restrictive permissions 51 51
for NTFS file system permissions for the local drives. 52 52
So from here, we're going to go ahead and click cancel 53 53
and this way we're not going to apply any changes, 54 54
because we didn't really make any changes. 55 55
So now if we want to go ahead 56 56
and fix some of these share permissions 57 57
to the way we want them to be, 58 58
we can do that by running the command inside of PowerShell. 59 59
So let's go into PowerShell 60 60
and we're going to go ahead 61 61
and type in cmd /c icacls \\ms1\c$\labfiles. 62 62
That's my share access. 63 63
Then /grant:r for read access instead of full control. 64 64
Then 'sec-glo-audit:(OI)(CI)R'. 65 65
So that command is going to go ahead 66 66
and apply those read permissions 67 67
to the security group that we are using, sec-glo-audit. 68 68
Now, once we do that, we want to verify our permissions, 69 69
and again, we can do this using the icacls command. 70 70
So we'll type in cmd /c icacls \\ms1\c$\labfiles. 71 71
So again, we're going to see what the ACLs look like 72 72
for this particular folder on that share drive. 73 73
Once we do that, we can check the output 74 74
and we can verify that we now have read permissions, 75 75
not full control, because we use that grant :R for read 76 76
and we use that OI CI flags, 77 77
which means the permission is inherited 78 78
for objects which are files and containers, 79 79
which are sub-folders within that share.