Windows 7 Understanding user accounts and file permissions

[WinUser]

Hi,

Can someone explain this to me.

(1)
When I go to "Control Panel -> User Accounts". There is only one account "User / Administrator".

Yet when I create a folder and look at the Security tab (in folder properties), there is a list of different users:
Administrators
SYSTEM
Users
Authenticated Users

These users don't appear in "Control Panel -> User Accounts"?

(And the owner of the folder is actually "User (User-PC\User)" which isn't even listed in the list??)

(2)
What I also don't understand is that on another drive letter (E) when I create a folder, I get a different list of users:
CREATOR OWNER
SYSTEM
User (User-PC\User)
Adminstrators
Users

The owner is still the same "User (User-PC\User)".

Why is that?

(3)
This folder that I created in E:\, and owner is "User (User-PC\User)". The permissions for "User (User-PC\User)" are all unticked except for "special permissions". Now, why does it not have the same permissions as "Administrators" (which has all ticked, full control, modify etc..), since the "User" account is an Administrator account??.

Thanks alot,

 

[Josephur]

You need to understand that there are groups not only users. Administrators includes any user in the Administrators group, Users includes anyone that is a user, Authenticated Users are any user, except a user of the Guest account, who is authenticated locally by a trusted domain controller.

SYSTEM is a special item which literally means the SYSTEM itself. Creator Owner is explained very well here.

So when you created a folder on E: the user "User" is the owner, if its an Administrator it will also inherit the Administrators group permissions specified. (Remember in Windows permissions stack, the only thing that kills permission inheritance is a DENY permission).

 

[WinUser]

Hi,

Thanks for the info.

Are you saying the permissions for User and Administrators will be combined for the given folder (if, as said above, User is an administrator)?

I have found this to be untrue. In a case where I can't perform an operation because User does not have permission, Administrators does have permission, but that does not help. I still need to edit the permissions for User and allow Full Control.

Case in point. I have been able to edit a .txt file in a folder on drive E. Now suddenly I can't edit this file without Admin permissions! And the current User is an admin! Why is this happening? (Problem seemed to start after running some sync software on the folder). (Yes I can get out of it by changing the permissions or changing the owner, but why is this happening in the first place?)

Thanks

 

[Josephur]

All permissions combine, the only permission that blocks other is a Deny.

Lets say you have a user George, which is in the Administrators Group. If George has Read Only access to file X but Administrators have Write access, George now has read/write access.

Please note there is a difference between "Administrator" and "Administrators".

Administrator would refer to a user account named Administrator, Administrators is a group which contains all the users who are members of the Administrators group.

 

[WinUser]

If there is a user called "User", and their account type is "Administrator" - will they then automatically be in the "Administrators" Group, or is there something else that needs to be done to get User into the Administrators Group?

Thanks