Now that we can read permissions, let's take it a step further and learn how to change permissions in Windows. Let's say I want to give access to another person in my family to view a folder with family pictures on the computer. How would I do that? On my local Disk C, I have a folder called vacation pictures that I want to share with another user on my machine, Devan. To do that, I'm going to right-click on this folder, then go to properties, then the security tab. Now I can see an option to edit file permissions. I'm going to click on that. From here, I can see that I can add a group or usernames to this aCho. I'm going to go ahead and click "Add". From here, it asks me to enter the username of the person I want to add on this aCho. I'm going to enter Devan and then click "Check Names" to verify that I typed it in right. After it's been verified, I'm going to click "Okay". Once Devan's added to the aCho, I can click on his username, then check the allow boxes for the permissions I want to give him. Let's give Devan modify access so you can add pictures to this folder too. That's it. We've been glossing over this other checkbox here deny. You might have already guessed that deny doesn't allow you to have a certain permission, but it's special because it generally takes precedence over the allow permissions. Let's say Devan is in a group that has access to this folder. If we explicitly check the deny box for Devan's username, even if the group has access to the folder, Devan won't. To modify a permission in the CLI, we're going to return to the iCacls command. In the examples I'm going to show you, we'll be running iCacls from PowerShell. The iCacls command was designed for the Command Prompt before PowerShell, and its parameters use special characters that confuse PowerShell. By surrounding iCacls parameters with single quotes, I'm telling PowerShell not to try and interpret the parameter as code. If you run these commands in command.exe, you'll need to remove the single quotes for them to work. Let's look at this side by side with powershell.exe and command.exe. In PowerShell, the command would be iCacls vacation pictures/grant, with single quotes, everyone OI CI R. In Command Prompt, the command would be, iCacls, with double quotes, vacation pictures grant everyone OI CI R. We're going to see what this command does in just a moment. For now, let's take a look at the difference in the quotes. In the PowerShell example, we add single quotes to make PowerShell ignore the parenthesis and because there's a space in the path. In the command.exe example, we have to use double quotes for the path, and we don't need the single quotes anymore to hide the parenthesis. Got it? Great. Now, let's take a look at the permissions that we just gave to Devan with iCacls. Cool. I see there's a new decal attached to the vacation pictures directory for Devan that gives him modify access. We can see that any new files or folders that get created in vacation pictures will be inherited. Let's say we want anyone with permission to use this computer to be able to see these pictures. We don't want them to add or remove photos though. What permissions do we want to give them? That's right. We want to give them read permission to the vacations pictures folder. Let's use the special group, everyone, to give read permissions to the directory, so iCacls see vacation pictures/grant everyone OI CI R. Success. The everyone group includes, well, everyone. It includes local user accounts like Cindy and Devan. Guest users. This is a special type of user that's allowed to use the computer without a password. Guest users are disabled by default. You might enable them in very specific situations. Now, anyone who can use this computer can browse the photos that Devan and I have put together. Actually, maybe I didn't really want everyone to look at my vacation photos. Maybe I just want the people that have passwords on the computer to be able to see them. In that case, I want to use Authenticated Users group. That group doesn't include guest users. First, let's add a new decal, iCacls see vacation pictures grant authenticated users OI CI R. Success. Now, let's remove the permissions for the everyone group, iCacls see vacation pictures remove, then everyone. Success. Now, let's use iCacls to verify that their permissions are set the way we intended, iCacls see vacation pictures. Sweet. We can see that authenticated users are added and everyone is removed.
