Before starting
Windows guest, local lab administrator, lab.employee, and a disposable folder such as C:\Lab\TeamDocs containing a sample text file.
Introduce the fault
As the lab administrator, create the sample folder with a controlled ACL. In Advanced Security, disable inheritance and convert inherited permissions into explicit entries. Keep SYSTEM and Administrators with full control. Remove only broad read entries for Users or Authenticated Users if present; initially omit lab.employee. Record the ACL before testing. Never alter Windows, profile, or real shared-data folders.
Diagnose before changing anything
- Ask for the full path and exact error. Establish whether the folder is local, a mapped share, or a cloud location. This exercise uses a local NTFS folder; a network share also has share permissions and connection checks.
- Test opening the same folder as the standard lab user and the administrator. Inspect Properties → Security → Advanced, including inheritance, explicit deny entries, ownership, and Effective Access for lab.employee.
- Record the current ACL with icacls C:\Lab\TeamDocs. Compare the user’s effective access with the intended access. Do not assume that ownership or administrator membership is the right solution.
Make the smallest appropriate change
Grant lab.employee read access to this test folder and its sample file through the Security tab. Keep administrative control intact. If the exercise later requires editing, document that requirement and grant only the necessary Modify permission.
Verify with the affected user
As lab.employee, open the sample file. Confirm read access works and that editing or deleting it is still denied for this read-only exercise. Record both the positive and negative checks.
Restore the baseline
Restore the recorded ACL or revert the dedicated lab checkpoint. Remove the disposable folder when the exercise is complete. Do not apply broad recursive permission changes to other paths.
Know when to escalate
Escalate unclear ownership, a real business folder with unknown access requirements, encrypted files, or a conflict between share and NTFS permissions that is outside your authority.
Evidence to collect
- The folder path with fictional names only
- ACL or Effective Access before and after
- Successful read and unsuccessful write as the standard user
- The business requirement used to choose the permission
INTERVIEW REFLECTION
Why was granting read access a better fit than making the user an administrator?
Write the ticket
Use the downloadable ticket template. Record the symptom, scope, timeline, checks, observed cause, action, verification, rollback, and escalation decision. Leave dates, elapsed time, root cause, and result blank until the exercise is performed.
Publication gate: replace “Planned” only after the exercise is reproducible and sanitized evidence has been reviewed. Describe it as an independent lab simulation.