1 1 00:00:00,480 --> 00:00:02,610 Analyzing share permissions. 2 2 00:00:02,610 --> 00:00:05,040 In this lesson, I'm going to show you how we can analyze 3 3 00:00:05,040 --> 00:00:08,340 the share permissions for our different file servers. 4 4 00:00:08,340 --> 00:00:09,840 Now to do this, we're first going to go 5 5 00:00:09,840 --> 00:00:11,820 into our server manager. 6 6 00:00:11,820 --> 00:00:14,520 Once we're in there, we're going to click on manage 7 7 00:00:14,520 --> 00:00:16,140 and then add servers. 8 8 00:00:16,140 --> 00:00:19,440 Then we're going to type MS 1 and click find now. 9 9 00:00:19,440 --> 00:00:23,490 MS 1 is a Windows 2016 server in my lab environment. 10 10 00:00:23,490 --> 00:00:25,260 Once I have that, I'm going to click it 11 11 00:00:25,260 --> 00:00:28,320 and then hit the right arrow to add it to the right pane 12 12 00:00:28,320 --> 00:00:29,640 and then click OK. 13 13 00:00:29,640 --> 00:00:31,410 This will add that file server 14 14 00:00:31,410 --> 00:00:33,870 into my server manager dashboard. 15 15 00:00:33,870 --> 00:00:35,910 Now that it's in my server manager dashboard, 16 16 00:00:35,910 --> 00:00:38,160 I can go to file and storage services, 17 17 00:00:38,160 --> 00:00:41,310 then click on shares and then click on audit. 18 18 00:00:41,310 --> 00:00:43,560 From here, we're going to right click on audit 19 19 00:00:43,560 --> 00:00:45,540 and select properties. 20 20 00:00:45,540 --> 00:00:48,000 Once we're there, we'll select permissions, 21 21 00:00:48,000 --> 00:00:49,230 and this is where we can start looking 22 22 00:00:49,230 --> 00:00:51,480 at the permissions for those shares. 23 23 00:00:51,480 --> 00:00:53,010 Now, as you can see here, 24 24 00:00:53,010 --> 00:00:55,440 the sec-glo-audit group, 25 25 00:00:55,440 --> 00:00:57,570 which we added in a previous lesson, 26 26 00:00:57,570 --> 00:01:00,840 has permissions of full control, not read only. 27 27 00:01:00,840 --> 00:01:02,580 So let's go ahead and change that. 28 28 00:01:02,580 --> 00:01:05,100 Next, let's click customize permissions. 29 29 00:01:05,100 --> 00:01:07,830 And note here that sec-glo-audit 30 30 00:01:07,830 --> 00:01:09,540 has been granted full control 31 31 00:01:09,540 --> 00:01:12,120 using NTFS file system permissions. 32 32 00:01:12,120 --> 00:01:14,040 These have been applied locally. 33 33 00:01:14,040 --> 00:01:16,170 Now, these NTFS file system permissions 34 34 00:01:16,170 --> 00:01:18,630 do propagate to child objects underneath 35 35 00:01:18,630 --> 00:01:20,880 and to containers as you're seeing here, 36 36 00:01:20,880 --> 00:01:23,280 or they can also be set separately. 37 37 00:01:23,280 --> 00:01:25,260 Now, if we go and click on the share tab, 38 38 00:01:25,260 --> 00:01:27,720 we can also look at the permissions for that share drive. 39 39 00:01:27,720 --> 00:01:29,670 These are simple share permissions. 40 40 00:01:29,670 --> 00:01:33,120 Here it allows for full control to authenticated users. 41 41 00:01:33,120 --> 00:01:34,950 This permission is going to apply to anyone 42 42 00:01:34,950 --> 00:01:37,830 who accesses this share drive over the network, 43 43 00:01:37,830 --> 00:01:40,620 whereas the NTFS permissions are when anybody accesses 44 44 00:01:40,620 --> 00:01:42,510 that domain controller locally. 45 45 00:01:42,510 --> 00:01:43,800 That's the difference. 46 46 00:01:43,800 --> 00:01:45,780 Now, it is considered a standard practice 47 47 00:01:45,780 --> 00:01:47,160 in Windows Administration 48 48 00:01:47,160 --> 00:01:49,680 to allow very permissible share permissions 49 49 00:01:49,680 --> 00:01:52,020 over the network, such as full control here, 50 50 00:01:52,020 --> 00:01:55,050 and then more constrictive or restrictive permissions 51 51 00:01:55,050 --> 00:01:59,040 for NTFS file system permissions for the local drives. 52 52 00:01:59,040 --> 00:02:01,410 So from here, we're going to go ahead and click cancel 53 53 00:02:01,410 --> 00:02:03,810 and this way we're not going to apply any changes, 54 54 00:02:03,810 --> 00:02:06,210 because we didn't really make any changes. 55 55 00:02:06,210 --> 00:02:08,010 So now if we want to go ahead 56 56 00:02:08,010 --> 00:02:09,660 and fix some of these share permissions 57 57 00:02:09,660 --> 00:02:11,130 to the way we want them to be, 58 58 00:02:11,130 --> 00:02:14,490 we can do that by running the command inside of PowerShell. 59 59 00:02:14,490 --> 00:02:16,080 So let's go into PowerShell 60 60 00:02:16,080 --> 00:02:16,980 and we're going to go ahead 61 61 00:02:16,980 --> 00:02:21,980 and type in cmd /c icacls \\ms1\c$\labfiles. 62 62 00:02:28,200 --> 00:02:29,910 That's my share access. 63 63 00:02:29,910 --> 00:02:34,910 Then /grant:r for read access instead of full control. 64 64 00:02:35,550 --> 00:02:40,550 Then 'sec-glo-audit:(OI)(CI)R'. 65 65 00:02:47,790 --> 00:02:49,710 So that command is going to go ahead 66 66 00:02:49,710 --> 00:02:51,870 and apply those read permissions 67 67 00:02:51,870 --> 00:02:55,530 to the security group that we are using, sec-glo-audit. 68 68 00:02:55,530 --> 00:02:58,110 Now, once we do that, we want to verify our permissions, 69 69 00:02:58,110 --> 00:03:01,710 and again, we can do this using the icacls command. 70 70 00:03:01,710 --> 00:03:06,710 So we'll type in cmd /c icacls \\ms1\c$\labfiles. 71 71 00:03:12,180 --> 00:03:14,790 So again, we're going to see what the ACLs look like 72 72 00:03:14,790 --> 00:03:17,550 for this particular folder on that share drive. 73 73 00:03:17,550 --> 00:03:19,500 Once we do that, we can check the output 74 74 00:03:19,500 --> 00:03:22,020 and we can verify that we now have read permissions, 75 75 00:03:22,020 --> 00:03:26,850 not full control, because we use that grant :R for read 76 76 00:03:26,850 --> 00:03:28,800 and we use that OI CI flags, 77 77 00:03:28,800 --> 00:03:30,810 which means the permission is inherited 78 78 00:03:30,810 --> 00:03:33,240 for objects which are files and containers, 79 79 00:03:33,240 --> 00:03:35,373 which are sub-folders within that share.