Windows isn't easier than Linux - Windows Permissions

Elena — Thu, 27 Aug 2026 10:11:34 +0000

I always heard people say that Linux is harder than Windows. Sure, but only if we're talking about everyday use.

I've finished the Linux fundamentals module on HackTheBox and was about to start "Windows Fundamentals" thinking "it's Windows, how hard could it possibly be? What are they going to show me? The GUI?"

What was about to come next caught me off guard: Windows is straight up confusing, and if you ask me what I think to be the most difficult concept to grasp I'd probably say "Windows Permissions"

Here I'll talk about NTFS permissions, not that service permissions are much better but I don't want to make the post confusing by talking about everything

Comparison - Linux Permissions

ls -l The output of this command would be something like:

-rwxr-xr--

Well, that is pretty straightforward, don't you think? For the ones who don't yet know what does that mean or those who need a refresher let's break it down:

- indicates that the resource is a file
rwx the first 3 characters are associated to the user who owns the file, "rwx" literally stands for read, write and execute. In this case the user has every permission
r-x are for the users who are in the group(s) of the owner
r-- other users have only the permission to read

Now, about Windows, a tool used for permissions is icacls, an example:
Command: icacls c:\Users
Output

c:\Users NT AUTHORITY\SYSTEM:(OI)(CI)(F)
         BUILTIN\Administrators:(OI)(CI)(F)
         BUILTIN\Users:(RX)
         BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
         Everyone:(RX)
         Everyone:(OI)(CI)(IO)(GR,GE)

Too many random letters and...duplicates? Why is (almost) everything shown twice? And... what is this?

ACL

Well, answering the last question first (I know you're usually supposed to start from the first) every line is an ACE (Access Control Entry), part of an ACL (Access Control List). Before thinking "oh, the names are pretty straightforward, I got it", let me tell you that there are two types of ACL

DACL (Discretionary Access Control List): the one we are looking at now: basically tells who can access a resource and who can't, which actions they can perform and how those permissions are propagated to subfolders (we're just missing the "why" but for that ask the admin)
SACL (System Access Control List): logs access attempts. We don't care about this now

(Basic) Permissions

Before you may ask yourself (or maybe you already did) whether there are also advanced permissions, I hate to break the news but yes, there are. We will talk about that later though.

There are 6 types of Windows basic permissions:

Full Access (F)
Read-Only Access (R)
Write-Only Access (W)
Read and Execute Access (RX)
Modify Access (M)
Delete Access (D)

And...7? I mean there's only No Access (N) left which isn't really a permission

A little plot twist: if you look at the Windows GUI you won't find "delete" in the basic permissions but you'll find "list folder contents" (not listed here). With icacls things are different: delete is a permission of its own, and list folder contents is part of RX

So, let's consider a part of our output


c:\Users ...
BUILTIN\Users:(RX)
BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
...

BUILTIN\Users often groups users with no special permissions that can perform basic tasks

The first line tells us the permissions, while the second line isn't about Windows changing its mind but tells us the inheritance

Inheritance

What is inheritance? it's simply the way permissions are passed to subfolders. Which children folders receive automatically what from their parent? Do they receive some permissions at all from them?
In our case we can see:

OI -> Object-Inherit, only files inherit the permissions
CI -> Container-Inherit, folders inherit the permissions
IO -> specifies which permissions the data / subfolders should get from the parent but the parent is excluded. The specified permissions, in this case are GR, GE which are advanced permissions

Points of confusion

A few things that quite confused me...

Files inherit permissions, containers inherit permissions and then...Inherit only? so are they inheriting or not?
The answer is that files and folders are just inheriting the permissions we choose
The duplicates we've seen before (e.g. for BUILTIN\Users) aren't everywhere, some users only have one line, are they special or what? Kind of. They have the same access to subfolders as the main folder

I'll admit I understood this while writing this post, I guess you never stop learning (or never actually start understanding)

Special (advanced) permissions

Imagine that you have the permission to work but it's divided into "permission to go to your workplace and work from a PC there" and "permission to do the tasks you're supposed to do". This doesn't make sense at first. Let's say that your contract states that you can work remote-only: now you can't just go there and demand a PC!

This is what Windows special permissions are about, they're "special" in the sense that they are granular. Every basic permission is made up of multiple special permissions but when I first learned this they had just given me two separate lists so I found it hard to find a correlation between the two things, so I'll group them here:

The basic read permission is made up of:
- List folder / Read data
- Read attributes
- Read extended attributes
- Read permissions
The basic write permission is made up of:
- Create files / Write data
- Create folders / append data
- Write attributes
- Write extended attributes
List folder contents and Read & Execute are made up of:
- All read permissions
- Traverse folder / execute file special permission
Modify (and Delete):
- All read permissions
- All write permissions + delete (resources and attributes)
Full control: all 13 permissions (all of the above + take ownership and change ownership)

Windows is easy until you start learning how it works under the hood. On Linux "everything is a file", on Windows "everything is a mess"

The beginning of my journey

Elena — Sat, 08 Aug 2026 10:36:13 +0000

I was interested in cybersecurity (mainly offensive) for a long time but I had no idea where to start. I remember finding a few apps on my phone and them being so superficial that I temporarily changed my mind: "is cybersecurity really just that?"

For a while I didn't think about it, I started learning web dev and then game dev (which I still like) but my mind sometimes went to "how do devs make anti-piracy games" and I loved when The Odin Project mentioned the difference between "textContent" and "innerHTML", touching XSS

One day I decided to search on my computer "how to learn how to hack" (I meant legally of course but I didn't even know it was called "ethical hacking") and TryHackMe's page showed up, I clicked on the first link I saw and registered

I tried the first room, I thought hacking was about typing fast, catching something at the right moment and trying to read a bunch of green text appearing on the terminal (very movie-like) but from that room I realized that it was more intuitive than this: it seemed like it was more about discovering what existed on the target to use to your advantage

From that day, more than a year passed, I've completed the legacy path of TryHackMe, Cybersecurity 101 and Jr Pentester (legacy), I'm still no expert, in fact I'm still a beginner, I'm learning the fundamentals (again) on HackTheBox and feel like I'm moving backwards instead of forward even though in reality I'm just developing stronger fundamentals to build on

I'm not sure where this journey will take me, and I'm still exploring every path I can. Cybersecurity is what has caught my interest the most at the moment but I also love game development and I'm fascinated by the use of AI in the medical field / bioinformatics

Here, I would like to explain concepts I've found either confusing or interesting (or both actually). I'm not a teacher nor a professional but I'll try to explain topics I like in a way I would've liked somebody to explain to me
Sometimes I'll just share opinions, thoughts or experiences

I'd love to read comments, feedback or some reactions, so feel free to share your opinion or the summary of your own journey below. Did you find your passion right away?

DEV Community: Elena