🎯

Aim / Objective

To explore and create Windows local user accounts and security groups; configure password policies and User Account Control (UAC); calculate effective NTFS permissions versus SMB Share permissions; and configure secure folder sharing over a Local Area Network with credential-based access.

🧰

Hardware & Software Requirements

Hardware Components

✓ Two desktop PCs connected over a common LAN / Switch (PC1: File Server, PC2: Client)
✓ Cat6 Ethernet cables

Software, OS & Tools

✓ Windows 10/11 Pro (Local Users and Groups: `lusrmgr.msc`, Local Security Policy: `secpol.msc`)
✓ Windows File Sharing / SMB 2/3 protocol enabled
✓ Command-line tools: `net user`, `net share`, `icacls`, `whoami`

👨‍🏫

Teacher's Lab Delivery Guide

Essential briefing notes, pedagogy, and setup tips for lab instructors

Faculty Exclusive

⏱ 5-Minute Pre-Lab Lecture Briefing:

Teach the golden rule of permissions: "When Share Permissions and NTFS Permissions clash, the MOST RESTRICTIVE permission always wins!" Explain that Share permissions only apply when accessing over the network (`\\server\share`), while NTFS permissions apply ALWAYS (both locally and across the network). Teach the Principle of Least Privilege: never give Everyone "Full Control".

📝 Key Concepts to Write on Whiteboard:

Account types: Administrator, Standard User, Guest, Microsoft Account vs Local Offline Account
User Account Control (UAC) security boundary and credential elevation tokens
Local Users and Groups (`lusrmgr.msc`) management
NTFS Permissions (Read, Write, Read & Execute, Modify, Full Control, Special)
SMB Network Share Permissions (Read, Change, Full Control)
Permission Inheritance and Explicit Permissions
Effective Permissions formula: `Effective = Most Restrictive(Share, NTFS)`
UNC (Universal Naming Convention) path format: `\\ComputerName\ShareName`

⚙ Pre-Class Lab Setup:

Ensure "Password protected sharing" is turned ON in Advanced Sharing Settings on both computers, and Network Profile is set to "Private" so network discovery is enabled.

⚠ Common Student Pitfalls & Fixes:

Students grant "Everyone: Full Control" on both tabs and forget that giving standard users "Full Control" allows them to change permissions and lock out the administrator. Teach them to use "Modify" instead of "Full Control".

🛡 Lab Safety & ESD Precautions:

Never disable User Account Control (UAC) entirely on production machines—UAC prevents background malware from silently gaining root/admin privileges.

📜

Step-by-Step Practical Procedure

1

Create Local User Accounts and Groups via `lusrmgr.msc`

Press `Win + R`, type `lusrmgr.msc`. Under "Users", right-click -> "New User...". Create two test accounts: `Student_User` (standard user) and `Faculty_User`. Set secure passwords and check "Password never expires" for lab testing. Under "Groups", create a group named `CSE_Lab_Members` and add both users.

Command / Action:

CLI equivalent: net user Student_User P@ssw0rd2026 /add

💡

Teacher Note / Pro-Tip: Standard user accounts cannot install kernel drivers or modify files in `C:\Windows`.

2

Create Folder Structure and Configure NTFS File Permissions

Create folder `C:\Lab_Shares\Project_Data`. Right-click folder -> "Properties" -> "Security" tab -> "Advanced". Click "Disable inheritance" -> "Convert inherited permissions into explicit permissions". Remove "Users" group. Click "Add", select `CSE_Lab_Members`, and grant "Read & Execute", "List folder contents", and "Read" permissions.

Command / Action:

Path: Folder Properties -> Security -> Advanced -> Permissions

💡

Teacher Note / Pro-Tip: Inheritance passes down permissions from parent folders (`C:\`); breaking inheritance allows custom folder isolation.

3

Configure SMB Network Share Permissions

In Folder Properties, click the "Sharing" tab -> "Advanced Sharing". Check "Share this folder". Set Share Name to `Project_Data`. Click "Permissions". Remove "Everyone". Add `CSE_Lab_Members` and grant "Change" and "Read" permissions. Click Apply and OK.

Command / Action:

CLI equivalent: net share Project_Data=C:\Lab_Shares\Project_Data /grant:CSE_Lab_Members,CHANGE

💡

Teacher Note / Pro-Tip: Adding a `$` at the end of the share name (e.g. `Project_Data$`) hides the folder from public network browsing.

4

Calculate and Verify Effective Permissions Matrix

In the "Security" tab -> "Advanced" -> "Effective Access" tab. Click "Select a user", type `Student_User`, and click "View effective access". Observe that even though Share has "Change", if NTFS is set to "Read", the effective access is strictly "Read".

Command / Action:

Rule: Effective Permission = Least Privilege between Share & NTFS

💡

Teacher Note / Pro-Tip: NTFS permissions always act as the ultimate firewall for local filesystem integrity.

5

Connect from Client PC over LAN via UNC Path

On the Client PC, press `Win + R`, type `\\192.168.1.X\Project_Data` (or `\\HostPC_Name\Project_Data`). When prompted for network credentials, enter `HostPC_Name\Student_User` and password. Open the share, create a file, and verify whether read or write succeeds according to the configured permissions.

Command / Action:

Run: \\192.168.1.X\Project_Data

💡

Teacher Note / Pro-Tip: Map the network drive permanently by right-clicking "This PC" -> "Map network drive..." assigning drive letter `Z:`.

⚡

Interactive Hands-On Lab Simulator

Practice and test concepts virtually before or after performing on physical lab equipment

Live Interactive

Loading simulator...

📊

Observations & Student Lab Record

Students are required to record the following measured parameters, hardware specifications, and output status into their physical lab journals:

Scenario	SMB Share Permission	NTFS Security Permission	Effective Network Access	Explanation
Scenario A	Full Control	Read Only	Read Only	NTFS restricts access; user cannot write or modify files.
Scenario B	Read Only	Full Control	Read Only	Share permission bottleneck restricts network write capability.
Scenario C	Change	Modify	Modify / Write	Both allow read, write, and delete; files can be edited and saved.
Scenario D	Change	Explicit Deny (Write)	Read Only (Deny wins)	An explicit "Deny" rule on NTFS always overrides any Allow.
Scenario E (Local Login)	N/A (Local Console)	Read Only	Read Only	Share permissions have zero effect on users logged in locally.

💡

Conclusions & Learning Outcome

Windows local user accounts, security groups, and password policies were created and administered using `lusrmgr.msc`. The interplay between SMB Share permissions and NTFS security permissions was verified across a live LAN. The fundamental rule of least privilege—where the most restrictive permission prevails—was confirmed through practical testing.

❓

Oral Exam & Viva Questions with Answers

Essential questions asked by external examiners and lab evaluators (Accordion UI)

Answer:

When accessing a folder over the network, the MOST RESTRICTIVE permission between the Share permission and the NTFS permission is the effective permission that actually applies to the user.