Predict every effective permission in writing, then test each one

short · 40 min · Objective 2.1

Task

Build a small permission structure, write down your prediction for each case BEFORE testing it, then test. The verify block counts your wrong predictions, and a number greater than zero is this lab working -- the whole point is to find the cases where the reasonable answer is not the right one.

Steps

  1. Create three accounts and two groups on the guest, with one account in both groups. Record them in lab/perm/principals.csv with header account,groups.
  2. Create a folder, share it, and set share and NTFS permissions that differ. Record both sets in lab/perm/config.csv with header principal,share_permission,ntfs_permission.
  3. BEFORE testing, write lab/perm/predictions.csv with header principal,access_path,predicted for at least six cases, covering both local and network access for each account.
  4. Test each case and write lab/perm/results.csv with header principal,access_path,predicted,actual,correct -- copying your prediction across unchanged.
  5. Add an inherited deny on a parent and an explicit allow on a child for the same account, predict, test, and add the rows. Write lab/perm/deny.md explaining what you observed.

Verify

awk -F, 'NR>1 && NF>=2 {n++} END {print n" principal(s)"}' lab/perm/principals.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" prediction(s)"}' lab/perm/predictions.csv
awk -F, 'NR>1 && NF>=5 {n++} END {print n" case(s) tested"}' lab/perm/results.csv
awk -F, 'NR>1 && $5 ~ /no/ {n++} END {print n" prediction(s) WRONG -- this is the point"}' lab/perm/results.csv
awk -F, 'NR>1 {print $2}' lab/perm/results.csv | sort -u | wc -l
grep -Eic 'explicit|inherit' lab/perm/deny.md

Six or more predictions made before testing, both access paths covered, and the deny note distinguishing explicit from inherited. If every prediction was right, the configuration you built did not include a case where the share and the NTFS permission disagree.

Notes

Write the predictions in a separate file and do not edit it afterwards. The temptation to quietly correct a prediction after seeing the result is strong, and it removes the only evidence the lab produces.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.