NTFS Permissions, Share Permissions and ACLs: The Windows Authorization Model

Concept

The Windows securable object model relies on Security Descriptors attached to every file, directory, registry key, and service:

Owner SID: Holds default legal control over the object and can always rewrite the DACL via WRITE_DAC.
Primary Group SID: Maintained for POSIX subsystem compatibility.
DACL (Discretionary Access Control List): An ordered list of Access Control Entries (ACEs) establishing who is permitted (Allow) or forbidden (Deny) to execute operations.
SACL (System Access Control List): Directs the security event log generation for access successes or failures.

Why This Matters in DFIR

Auditing NTFS permissions and SMB shares answers critical intrusion questions:

Establishing Exfiltration Scope: Prove definitively whether a compromised user account possessed the authorization to read target repositories.
Reconstructing Ransomware Execution: Reconstruct which account deposited encrypted extensions and modified files on central file servers.
Identifying DACL Tampering for Persistence: Threat actors modify object DACLs (e.g., adding an Allow GenericAll ACE for a low-privilege user on a service binary or the AdminSDHolder container).

How It Works

1. DACL Evaluation Algorithm

The Security Reference Monitor (SRM) evaluates ACEs from top to bottom:

[Access Request: Read + Write]
         │
         ▼
┌────────────────────────────────────────────────────────┐
│ 1. Explicit ACE : DENY Write (Interns Group)           │ ──► Immediate Write Denial!
├────────────────────────────────────────────────────────┤
│ 2. Explicit ACE : ALLOW Read (jdoe)                    │ ──► Read Access Granted!
├────────────────────────────────────────────────────────┤
│ 3. Inherited ACE: ALLOW Write (Users Group)            │ ──► Ignored due to prior explicit deny
└────────────────────────────────────────────────────────┘

Canonical ACE Order:

Explicit Deny
Explicit Allow
Inherited Deny
Inherited Allow

If an explicit Deny matching the caller is encountered, access is immediately denied. When all requested access bits are satisfied by Allow ACEs, the check succeeds. If the end of the DACL is reached with unsatisfied access bits, access is denied by default.

2. SMB Shares vs NTFS Permissions

Network (SMB) ──► [Share Permissions] ──► [NTFS Permissions] ──► File on Disk

Share Permission	NTFS Permission	Effective Network Access	Effective Local Console Access
`Everyone : Read`	`Everyone : Full Control`	Read Only	Full Control
`Everyone : Full Control`	`Everyone : Read`	Read Only	Read Only
`Domain Users : Change`	`Domain Users : Modify`	Modify (Write)	Modify (Write)
`Everyone : Full Control`	`jdoe : Deny Write`	Write Denied for jdoe	Write Denied for jdoe

What Is Possible

Being Owner Without Read Rights: An owner stripped of Read permissions cannot read the file immediately, but holds WRITE_DAC authority to grant themselves access.
Bypassing DACLs via SeBackupPrivilege: Backup utilities (and adversaries holding this right) open files with FILE_FLAG_BACKUP_SEMANTICS, instructing the kernel to bypass DACL checks.
Administrative Hidden Shares: Appending $ (e.g., C$, ADMIN$) hides the share from browser enumeration but enforces standard ACL checks.

What Is Not Possible

Overriding an Explicit Deny via Group Membership: If user jdoe is in Domain Admins (Allow), but an explicit ACE sets jdoe: Deny, access is denied.
Network Writes Through Read-Only Shares: Even Domain Admins cannot write through a share restricted to Read.

Forensic Artifacts

EventID: 5140 # Network Share Object Was Accessed
ShareName: \\*\Finance
IpAddress: 192.168.1.105
SubjectUserName: jdoe

EventID: 5145 # Network Share Object Check (Detailed Triage)
ShareName: \\*\Finance
RelativeTargetName: Invoices\salaries_2026.xlsx
AccessMask: 0x120089 # ReadData, ReadEA, ReadAttributes, ReadControl
SubjectUserName: jdoe
SubjectUserSid: S-1-5-21-111111111-222222222-333333333-1105

Key Takeaways

Network access is bounded by the most restrictive setting between Share and NTFS.
Explicit Deny ACEs take precedence over all Allow ACEs.
The Owner of an object can always modify its DACL.
Event ID 5145 documents specific file targets and the requested AccessMask.