Help with Permissions

[SolidSponge]

Need someone to clarify this for me please

I'm doing a few mock exams at the moment and one section I'm struggling on is Share and NTFS Permissions.

For example, I've just had a question and I was convinced I had it right but I got it wrong and I don't see how!?

Question was...

Your are the desktop admin for xxxx network. xxxx network consists of a single AD domain. Helen, a domain user in the HR dept, reports that her Windows XP PC is running out of Hard Disk space.
To solve this problem you decide to implement file compression on the archive folders on her Hard Disk. You log in as local Administrator and you attempt to compress the folders but you get the following error...

An error occurred applying attributes to the file:

C:\Archives\HRDocs\Inactive\Emplist.doc

Access is denied

To troubleshoot this you start by reviewing the NTFS permission of the local Administrators group on Helen's computer. The NTFS Permissions are as follows...



You need to compress files and folders on Helen's computer. What should you do?

A. Instruct Helen to un-encrypt the files and folders that you want to compress
B. Take ownership of the files and folders. Then select the Compression attribute for the files and folders
C. Grant the local administrator account Allow-Full Control permission on the files and folders
D. Grant the local administrator account Allow-Modify permission on the files and folders

Now I thought the answer would be A. Why? Well because it's the only one that makes sense after looking at the permissions example.
I know the answer now and sort of understand why (after looking at it again), but if anyone would like to have a go and give me your reasoning for the answer then that would be great

[Mr.Cheeks]

I would of selected

B. Take ownership of the files and folders. Then select the Compression attribute for the files and folders

as
A - not relevant NTFS if i recall correctly can only do one of the other, either compress or encrypt...
C & D - Thats a NO NO, your the Admin, you have control!

Im sure others will input

[BosonMichael]

Where'd you pull this question from? Wouldn't want you or CertForums to get into any copyright violation issues, ya know?

[Sparky]

I`ll guess C


Just to note that admins dont always have full control but they do have the right to take ownership

[Mr.Cheeks]

dammit! never realised it said local administrator! *note to self again, always read questions 3 times.

[SolidSponge]

Originally Posted by BrainBeacon Michael

Where'd you pull this question from? Wouldn't want you or CertForums to get into any copyright violation issues, ya know?

Don't wory it's been re-worded a lot, but it's pretty much the gist of the question I had. Oh and the screenshot is from my PC too as the one on the exam was awful!

[Sparky]

To be honest Im not sure what the answer is, B is a possibility.

I only said that admins dont always have full control. For example a roaming user profile on a server cant be viewed by the domain admins group but you can take ownership if required and change the permissions.

[SolidSponge]

Answer was B.

First I thought, that can't be right as it clearly shows that the Administrator doesn't have Take Ownership. But they're Admins right, so surely they can grant themselves Full Control? Or am I missing something?

[SolidSponge]

Originally Posted by Sparky

To be honest Im not sure what the answer is, B is a possibility.

I only said that admins dont always have full control. For example a roaming user profile on a server cant be viewed by the domain admins group but you can take ownership if required and change the permissions.

Yeh that's what I thought first, then changed it. I just wanted to get some other opinions on it too as I have my exam next week and this is this one area I'm constantly having problems with!

[Sparky]

Originally Posted by SolidSponge

Answer was B.

First I thought, that can't be right as it clearly shows that the Administrator doesn't have Take Ownership. But they're Admins right, so surely they can grant themselves Full Control? Or am I missing something?

Yes, the admins can take ownership and then grant themselves permissions.

[dales]

would you get a diff error message then if you try to compress an encrypted file.

[dales]

tried it out at home, made a new folder and created a subfolder with a text doc in it, encrypted the subfolder and applied to folder contents. Then compressed the parent folder, it compressed the parent folder but left the encrypted folder alone, with no error message or anything.

[Mr.Cheeks]

Originally Posted by dales

would you get a diff error message then if you try to compress an encrypted file.

as far as i am aware, you cannot compress an encrypted folder, or encrypt a compress folder. the folder can only be one of the two; either encrypted or compressed but not both.

[Kerfuffle]

But what are you actually doing - permissions wise - when you attempt to compress a folder. Surely you are only changing an attribute and according to the question, the admin has write attributes and write extended attributes. Surely he/she doesn't need to own the folder and take full control?

[Kerfuffle]

Sorry guys, I've gotta bump this as I can't seem to find specific information out there on the Web with regards to what exactly each of the special permissions do. Please correct me if I'm wrong but writing attributes includes compressing and encrypting folders.

I've got the 70-270 Sybex and MS book plus I am trawling the web and this forum but I'm still unclear. Why can't he/she compress this folder as is? What, exactly, is stopping them from doing this?

Forgive me for this persistent ignorance, but I can't justify it at the moment in my head. I'm in a right kerfuffle