Understanding how Windows decides who gets access to what
LFI Security Hub • Prepared for HR • March 2026
The 6 levels of file/folder access
Security descriptors & access control entries
How permissions flow from parent to child
Network access control explained
C$, ADMIN$, IPC$ — hidden shares
The golden rule of access control
Every file and folder on an NTFS volume has permissions that control exactly what users can do. Think of them as a graduated set of keys — each unlocking a different level of access.
| Permission | What It Allows | Includes |
|---|---|---|
| Read | View file contents, attributes, and permissions | — |
| Write | Create new files/subfolders, modify attributes | — |
| List Folder | View file & subfolder names (folders only) | Read |
| Read & Execute | Read + run executables, traverse folders | Read + List |
| Modify | Read & Execute + edit/delete files | R&E + Write + Delete |
| Full Control | Modify + change permissions + take ownership | Everything |
Each level includes all permissions below it. Full Control is the most powerful.
Every securable object in Windows has a Security Descriptor containing:
Who owns the object — can always change its permissions
Discretionary ACL — controls who can access the object
System ACL — controls what gets audited (logged)
Permissions set on a parent folder automatically flow down to all children. Controlled by inheritance flags:
| Flag | Code | Meaning |
|---|---|---|
| Object Inherit | (OI) | Inherited by files in child folders |
| Container Inherit | (CI) | Inherited by subfolders |
| Inherit Only | (IO) | Applies only to children, not the folder itself |
(OI)(CI)This folder + all subfolders + all files
Most Common(OI)(CI)(IO)Subfolders and files only — NOT the folder itself
Partial(CI)(IO)Subfolders only — not files, not this folder
Specific(OI)(IO)Files only — not subfolders, not this folder
SpecificWindows has two completely separate permission systems that can apply to the same resource:
The Front Gate
The Office Door
Over the network, you must pass through both locks. Effective access is always the most restrictive combination.
When accessing locally (logged in at the machine), share permissions don't apply — only NTFS matters.
| Feature | Share Permissions | NTFS Permissions |
|---|---|---|
| Applies when? | Network access only | Always (local + network) |
| Granularity | 3 levels | 6 levels + special permissions |
| Applied at | The share (folder level only) | Any file or folder |
| Inheritance? | No — share-level only | Yes — flows to subfolders/files |
| Tool | net share, Computer Mgmt | icacls, Properties → Security |
Windows creates hidden shares automatically (ending with $). They don't show in Network Neighborhood.
C$Entire C: drive
Remote file system access. Every drive gets one (D$, E$…)ADMIN$C:\Windows
Used by PsExec and remote admin tools to push executablesIPC$Inter-Process Communication
Named pipes, remote management. Used in null session attacks\\target\C$ gives full drive access. Monitor via SACL auditing!"Every user, program, and process should have only the minimum permissions necessary to do their job — nothing more."
Key Takeaways
LFI Security Hub • Questions?