Sharing and permissions

• Explain

  I can distinguish share access from NTFS file access.

• Test

  I can prove the intended user can read or edit the practice file.

• Connect

  I can map the share and explain its ownership.

How do you want to study?

Touch, mouse, or keyboard. No grades or saved progress. Optional timer and temporary game points in Describe It!

Use two assigned guests with distinct names, guest rights and recovery. Verify the approved router-LAN or bridged classroom route before students begin. Separate NAT adapters are not a shared guest LAN; an Internal Network name joins only VMs on the same physical host. Bridged peers need school-network permission. Preserve authentication, signing and firewall protections. Do not use the dedicated sharing identity as an administrator or folder owner. Before removing broad groups, preserve explicit Full control for the signed-in working host user as well as the existing owner, SYSTEM and Administrators; an owner group alone may be filtered from ordinary Explorer access. Confirm ShareReader effective Read is not defeated by inherited/group write rights. No private password appears in the handout.

Practice guests only. Change only the new named folder/share and dedicated lab identity. Never share C:, a whole profile or real personal files. Do not disable the firewall, SMB signing or password protection, enable insecure Guest/SMB1, or change host networking. Stop on an unexpected permission, identity or network state.

Original teaching for IT Specialist Device Configuration and Management objective 3.2.

Introductory access-control reasoning; not a compliance assessment.

• Visible purpose, exact controls and expected result at every action.
• Optional depth is expandable; essential restrictions stay visible.
• Partial unscored PDF export and labeled correct/review/not-answered feedback.

• Microsoft: Windows access control

  Security principals, NTFS permissions, inheritance and ownership.

• Microsoft: sharing files and mapping a drive in Windows

  Windows 11 Explorer routes. This lab retains password-protected sharing and existing security controls.

• Microsoft: how access-control lists are evaluated

  Requested rights, applicable entries and access-check ordering; not a universal most-restrictive rule within an ACL.

• Microsoft: ordering explicit and inherited entries

  Distinguish explicit entries from inherited entries and their ordering.

• Microsoft: file and directory access rights

  Create files/Write data has different meanings for a directory and a file.

• Microsoft: SMB signing

  Use authenticated sharing; do not disable signing or enable insecure Guest access.

• Microsoft: taking ownership

  Authorized recovery; changing ownership does not itself grant ordinary file-content access.

• Oracle VirtualBox: virtual networking

  NAT, Internal Network and bridged networking have different reachability boundaries.

• Microsoft: folder access and the Continue prompt

  Continue can permanently change a folder ACL. Preserve the authorized working host user explicitly on this new practice folder; do not use a surprise Continue prompt to repair unrelated data.

• Microsoft: how User Account Control works

  Ordinary Explorer uses the standard token. Administrator membership is not the same as an explicit ordinary folder-access grant.