Learn Understand first, then practice while the concept is still fresh.

M17 - Permissions Lab: Diagnose and Fix

Use a safe practice folder to inspect, break, diagnose, and restore access so permission troubleshooting feels systematic instead of scary.

Permissions

Permissions Lab: Diagnose and Fix

Use a safe practice folder to inspect, break, diagnose, and restore access so permission troubleshooting feels systematic instead of scary.

35 min INTERMEDIATE BOTH Curriculum-reviewed
Prerequisites
Module M12 - Who Owns What: Users and Groups Module M14 - Users and Groups: CLI Module M15 - Permissions: NTFS and Linux rwx Module M16 - Elevation: UAC and sudo
What you should be able to do after this
  • Create a safe permissions sandbox.
  • Observe how one permission change affects access.
  • Restore access by reasoning from the permission model instead of guessing.

The Goal

This lab is about calm troubleshooting.

You will create a disposable practice folder, confirm access works, remove one permission on purpose, observe the failure, and restore the correct state.

Boundary

Stay inside the practice folder for this entire lab. Do not apply these commands to your real home directory, work repository, or system folders.

Step 1: Create the Sandbox

Create a Windows Practice Folder

cd $env:USERPROFILE mkdir -Force PermSandbox Set-Content -Path .\PermSandbox\notes.txt -Value “permissions practice” Get-Content .\PermSandbox\notes.txt

Create a Linux Practice Folder

cd ~ mkdir -p PermSandbox printf “permissions practice\n” > ./PermSandbox/notes.txt cat ./PermSandbox/notes.txt

At this point, reading the file should work.

Step 2: Break Access in a Controlled Way

Windows

Use a practice-only deny rule on the file, then confirm the read fails.

Break Read Access in Windows

icacls .\PermSandbox\notes.txt /deny “$env:USERNAME:(R)” Get-Content .\PermSandbox\notes.txt

Linux

Remove your read permission from the file, then confirm the read fails.

Break Read Access in Linux

chmod u-r ./PermSandbox/notes.txt cat ./PermSandbox/notes.txt

The point is to see one permission change produce one clear consequence.

Step 3: Diagnose Before Fixing

Before changing anything else, inspect the current state.

Inspect the Windows ACL

icacls .\PermSandbox\notes.txt

Inspect the Linux Permission String

ls -l ./PermSandbox/notes.txt

Ask yourself:

  1. Which identity is affected?
  2. Which right is missing or denied?
  3. What is the smallest change that restores normal access?

Step 4: Restore Access

Restore Read Access in Windows

icacls .\PermSandbox\notes.txt /remove:d $env:USERNAME Get-Content .\PermSandbox\notes.txt

Restore Read Access in Linux

chmod u+r ./PermSandbox/notes.txt cat ./PermSandbox/notes.txt

If the file opens again, you completed the loop correctly.

Optional Extension

Once the basic loop feels comfortable, try a directory-focused version.

  • on Linux, remove the execute bit from a practice directory and observe how traversal changes
  • on Windows, inspect a folder ACL instead of a file ACL and compare the inherited entries

Only do this in the sandbox.

Move On When

You are ready for the next section when you can:

  1. create a practice permission problem safely
  2. inspect the current state before guessing
  3. restore access with a targeted fix

That is the real permissions skill: diagnose first, change second.