Create Modify and Remove File and Folder Permissions in Windows PDF
Create Modify and Remove File and Folder Permissions in Windows PDF
Permissions in Windows
1 hour1 Credit
Introduction
In this lab, you'll learn the foundations of how managing user permissions works
on a Windows machine. Using the new Powershell commands you learned, you'll
fix up the permissions of some files and folders.
Head's up: You'll experience a delay as the labs initially load (particularly for
Windows labs). So, please wait a couple of minutes for the labs to load.
Please also make sure to access the labs directly through Coursera and not in
the Qwiklabs catalog. If you access the labs through the Qwiklabs catalog, you
will *not* receive a grade. (As you know, a passing grade is required to
matriculate through the course.) The grade is calculated when the lab is
complete, so be sure to hit "End Lab" when you're done!
You'll have 60 minutes to complete this lab.
What you'll do
In this lab, you'll create and change folder permissions using the Windows
Command Line Interface (CLI), known as Powershell. In this exercise, you'll:
access administrative privileges to use Powershell in Windows.
view file and folder permissions using the GUI and Powershell commands.
modify the permissions for both files and directories by granting and
removing specific permissions using ICACLS in Powershell.
modify the permissions for groups using the GUI and Powershell.
Go ahead and connect to the windows-instance Google Cloud VM now. As a
reminder, your machines are available in Google Cloud Console under Compute
Engine > VM instances. If you're having difficulty connecting to your instance, no
worries! Just follow the steps outlined in the Accessing Qwiklabs reading for
detailed instructions on how to connect.
Permissions Using Windows Powershell
Powershell is used through the rest of the lab, and you'll need administrative
privileges. Open it now by searching for "Powershell" in the start menu, then
rightclicking it and selecting "Run as Administrator".
Example 1
In "C:\Users\Qwiklab\Documents\" you have a file named "important_document."
Your goal in this example is to change the permissions so that the user "Kara"
only has read access to the file.
First, use ICACLS to view the existing permissions for the file using this
command:
ICACLS C:\Users\Qwiklab\Documents\important_document
As you can see, Kara currently has read and write permissions (shown as "R"
and "W"). We need her to only have read permissions, so we need to remove her
write permission. An easy way to accomplish this is to remove all of Kara's
permissions and then readd her read permission. You can remove her entirely
from the file's permissions and check to see that it worked with these commands:
ICACLS C:\Users\Qwiklab\Documents\important_document /remove "Kara"
ICACLS C:\Users\Qwiklab\Documents\important_document
As you can see, Kara is no longer listed in the file's permissions. To regrant her
only the read permission, use this command:
ICACLS C:\Users\Qwiklab\Documents\important_document
Example 2
There's a folder called "Secret" in "C:\Users\Qwiklab\" where the user "Kara" has
read access. Your goal in this example is to alter these permissions so that
another user (named "Phoebe") has read permissions as well, and Kara has both
read and write permissions. You can view the current permissions with this
command, and see that Kara has read permissions and Phoebe is not included.
ICACLS C:\Users\Qwiklab\Secret\
First, give Phoebe read access. You can grant her these permissions with the
command below, like before. Then, use the previous command again to verify
that the change has been made:
ICACLS C:\Users\Qwiklab\Secret\
Example 3
There's another folder in "C:\Users\Qwiklab\" called "Music". The user group,
named "Everyone", has both read and write permissions for this folder. User
groups are sets of local users that allow you to change multiple users'
permissions at once. For example, a computer that's used by lots of employees
at a business may have a usergroup called "Employees" that new hires are
added to when they onboard. This automatically gives them access to everything
they need, without it having to be set manually. The "Everyone" group is created
by default, and every new user is automatically added.
Your goal for this example is to change the permissions for this folder so that the
"Everyone" group only has read permission (not write).
As usual, view the current permissions with this command:
ICACLS C:\Users\Qwiklab\Music\
You can change permissions for groups in exactly the same way as you do for
users. To remove the group's current permissions, and then regrant them a read
permission, use these commands:
ICACLS C:\Users\Qwiklab\Music\
Example 4
Back in the "documents" folder from before, there's a file called
"not_so_important_document". In this example, you need to modify the
permissions for that file so that the group called "Authenticated Users" has
"Write" access. The "Authenticated Users" group is another automatically created
group, containing all users with admin privileges. View the current permissions
with this command, to see what the starting point for this file is:
ICACLS C:\Users\Qwiklab\Documents\not_so_important_document
This will show you that the "Authenticated Users" group is currently not listed.
This means that the only step required is to grant them write access, which you
can do with this command:
That should successfully grant them write permissions. You can use the same
command as earlier to verify that the commands were a success:
ICACLS C:\Users\Qwiklab\Documents\not_so_important_document
Example 5
In this final example, you'll change the permissions of another file in the
"Documents" folder. The file named "public_document" needs to be made
publically readable, so that anyone on the system is able to read it. As usual,
view the file's commands first:
ICACLS C:\Users\Qwiklab\Documents\public_document
The easiest way to make sure that all users on the system have read
permissions is to add those permissions to the "Everyone" group. You could also
add each user manually, but by giving the group the permissions instead, you
save time; it removes the need to go back and edit permissions again if a new
user is created in the future. Grant every user on the system the ability to read
the file using this command:
Finally, view the permissions again to make sure it worked:
ICACLS C:\Users\Qwiklab\Documents\public_document
Conclusion
Wohoo! You've successfully used Powershell to modify the permissions for both
files and directories. You modified the permissions by granting and removing
specific permissions using ICACLS. You've also become familiar with groups of
users, and how to modify permissions for them as well. Really well done.