Decode NTFS permission sets and calculate effective permissions when multiple groups or inheritance sources combine.
Select Allow and Deny for each permission to see the effective result.
| Permission | Allow | Deny |
|---|---|---|
| Full Control | ||
| Modify | ||
| Read & Execute | ||
| List Folder Contents | ||
| Read | ||
| Write |
Select permissions above to see results
Add multiple permission sources to compute combined effective permissions.
| Permission | Allow | Deny |
|---|---|---|
| Full Control | ||
| Modify | ||
| Read & Execute | ||
| List Folder Contents | ||
| Read | ||
| Write |
Add permission sources above to see combined results
NTFS (New Technology File System) permissions control who can access, modify, or delete files and folders on Windows systems. There are six standard permissions that can be granted or denied individually:
Full ControlRead, write, modify, delete, change permissions, and take ownership of the file or folder.ModifyRead, write, and delete the file or folder, but cannot change permissions or take ownership.Read & ExecuteOpen files and run applications; includes List Folder Contents for folders.List Folder ContentsView the names of files and subfolders in a directory (folder-only permission).ReadOpen and view file contents or folder listings, but cannot make changes.WriteCreate new files, write data to existing files, and create subfolders.Each NTFS permission can be set to Allow or Deny. When both are present for the same permission, Deny always wins. This is a critical rule: a single Deny entry overrides any number of Allow entries, regardless of where they come from.
For example, if a user belongs to Group A (Allow Read) and Group B (Deny Read), the effective permission is no Read access. Deny takes precedence even if the Allow comes from a parent folder and the Deny is set directly on the file.
Because of this behaviour, Deny entries should be used sparingly. In most cases, the preferred approach is to simply not grant Allow permissions rather than explicitly denying them. Overusing Deny can create confusing permission sets that are difficult to troubleshoot.
When a user is a member of multiple groups, each with different NTFS permissions on the same resource, Windows calculates the effective permissions using these rules:
Inheritance also plays a role: permissions flow down from parent folders to child objects unless inheritance is blocked. A file inherits the cumulative Allow permissions of all parent folders, minus any Deny entries encountered along the chain.
When a user accesses a file over the network via a Windows share, both NTFS permissions and share permissions apply. The effective access is the most restrictive combination of the two.
For example, if share permissions grant Full Control but NTFS permissions only allow Read, the effective network access is Read. Conversely, if NTFS allows Full Control but share permissions only allow Read, the result is still Read. The most restrictive permission from either layer always wins.
A common best practice is to set share permissions to Full Control for Everyone and manage actual access control entirely through NTFS permissions. This simplifies administration because you only need to manage one permission layer instead of coordinating two.
DMC IT Services designs and manages Windows file server permissions and access control strategies for SMBs across London, Cambridge, Hertfordshire, and Bedfordshire — from initial NTFS permission structures through to Active Directory group policy and share configuration.
Talk to an Engineer