Permissions and Drives
Drive Letters vs. a Unified Root
Linux has a single root filesystem (/). Every disk, partition, and network share is mounted somewhere under that root — /mnt/data, /home, /var. There is one unified namespace.
Windows uses Drive Letters (C:\, D:\, E:\). Each partition or disk is a separate namespace. C:\ is typically the system drive. Additional drives appear as separate letters. This means paths are not portable across drives — a script that references C:\logs will fail if logs are on D:\. (Windows does support mounting drives to folders, e.g., mounting a disk to C:\data, but this is uncommon in practice.)
NTFS ACLs: More Granular Than Linux
Linux file permissions are a simple 9-bit model: read/write/execute for owner, group, and others. It is elegant and predictable.
NTFS (New Technology File System) uses Access Control Lists (ACLs) — a list of explicit permission entries attached to every file and folder. Each entry in the list is called an Access Control Entry (ACE) and specifies:
- Who: A user or group (identified by their SID — Security Identifier)
- What: One or more specific permissions
- Type: Allow or Deny
The granular permissions available in NTFS include:
| Permission | Meaning |
|---|---|
| Full Control | Everything, including changing permissions |
| Modify | Read, write, delete, execute |
| Read & Execute | Read files and run programs |
| List Folder Contents | See what's in a folder (folders only) |
| Read | Read file contents and attributes |
| Write | Create files, write data, change attributes |
| Traverse Folder | Pass through a folder even without List permission |
| Take Ownership | Become the owner of the object |
Inheritance
By default, files and folders inherit permissions from their parent folder. If you grant the Developers group Read access to C:\Projects, all subfolders and files automatically inherit that permission. You can break inheritance on any individual object and set custom permissions — but this creates complexity that is hard to audit.
The Deny Override
The most important rule in NTFS permissions: an explicit Deny always overrides an explicit Allow, regardless of where the Allow comes from. If a user is in a group that has Allow, but also in a group that has Deny, the Deny wins. This is a deliberate security design — it allows administrators to carve out exceptions without restructuring group membership.
Effective Permissions
Because a user can be in multiple groups, each with different ACEs, calculating what a user can actually do requires evaluating all ACEs that apply to them. Windows provides an "Effective Access" tab in the file properties dialog, and PowerShell's Get-Acl cmdlet (paired with the community NTFSSecurity module's Get-NTFSEffectiveAccess for a specific account) to inspect this programmatically instead of clicking through the GUI.