Vista: setting file permissions

Question

I have a server running on Windows Vista and am having problems setting file permissions.

I want to set a folder to 777, but when unselecting read-only from Explorer, after going back to it read-only is selected again!

How can I change the file's permissions?

Answer 1

I think you don't have a read-only attribute for folders under Windows, i.e. you can only set it on files. (So it's always displayed as a square instead of a tick.)

The UNIX 777 permission are generally unnecessary if you're setting up some website or programming environment under Windows and normally creates security problems if you grant Everyone all permissions.

The best practice is to understand why the 777 permission is necessary for that particular folder and grant the "Modify" or "Full Control" permission to the correct user. For example, if you want to make a folder writable by some PHP script running in IIS, just grant the IIS user (you have to find out which one since it's different with different IIS setup) Modify permission.

Answer 2

• Right-click the file and select Properties.
• Click on the Security tab.
• Click Advanced in the lower right.
• In the Advanced Security Settings window that pops up, click on the Owner tab.
• Click Edit.
• Click Other users or groups.
• Click Advanced in the lower left corner.
• Click Find Now.
• Scroll through the results and double-click on your current user account.
• Click OK to all of the remaining windows except the first Properties window.
• Select your user account from the list up top and click Edit.
• Select your user account from the list up top again and then in the pane below, check Full control under Allow, or as much control as you need.
• You'll get a security warning, click Yes.

On some files that are essential to Windows, you'll get a "Unable to save permission changes... access is denied" warning and there's nothing that you can do about it to the best of my knowledge.

Reconsider why you're using Windows.

That's generally how the process goes. You don't want to be doing this too often though.

Answer 3

From an elevated Command Prompt, type:

CACLS /g username

This will grant all permissions. I might have provided the incorrect usage but typing CACLS /? will tell you for sure.

Answer 4

Windows Explorer does not let one directly get at the read-only attribute of folders from a properties dialogue box.

The "read-only" checkbox displayed in the dialogue box is not the folder attribute. It's a mechanism for changing all of the files within the folder (and, optionally, within its subfolders) to or from read-only. It only changes files, not directories, moreover.

To access the read-only attribute of a folder, one has to use tools other than Windows Explorer, that do let one access the actual attribute flag, such as the ATTRIB command.

The read-only attribute does not make directories read-only on Windows in any case.

No version of MS-DOS, PC-DOS, OS/2, or Windows NT has ever enforced the read-only attribute for directories. You're being misled by Unix Think. You shouldn't be thinking in terms of "setting 777" and permissions flags, and then looking for equivalent attribute flags. The POSIX user-group-other permissions system has no direct analogue in Win32.

In the Windows NT world, you should be looking at (discretionary) access control list entries. Windows NT has ACLs, and as billc.cn said you should be adding an access control entry to each file that grants the specific access right to the specific user/group account that needs that particular access to that particular file. There are plenty of ways to change ACLs in Windows, from the properties dialogue in Windows Explorer to the CACLS command. And there are umpteen SuperUser questions already covering these tools.

The specific access right for the ability to create files in a directory, to grant for that directory by adding an entry to its ACL, is the create files/write data right.

Windows Explorer re-uses the unused read-only attribute bit on directories for its own special purposes.

Since the read-only attribute on a directory has no meaning to the operating system, Windows Explorer re-uses it for its own purposes. If set, this flags to Windows Explorer that it should go looking for a desktop.ini for folder customizations that alter how the folder is to be displayed.