Logical Drives overview

Logical Drives is a Windows Management Instrumentation (WMI) tool that lets you manage mapped drives and local drives on a remote computer or local computer. Using Logical Drives you can:

View drive properties

Examples of drive properties include the drive type, the letter assigned to the drive, the type of file system used to format the drive, the amount of space available on the drive, and security settings.

Set drive labels

Each drive can have a unique label containing up to 11 characters. The drive label is displayed with the drive letter and can help you identify drives.

Change security settings

You can change security settings for both local drives and mapped drives. Security settings include access permissions, audit entries, and ownership.

You can change drive properties only on computers for which you are an administrator. In addition, you can only change security settings on drives formatted to use NTFS.

Related Topics


View drive properties

To view drive properties

  2. In the console tree, click Logical Drives.

    Where?

    • Computer Management (Local)
    • Storage
    • Logical Drives
  3. Right-click the drive for which you want to view properties, and then click Properties.

Notes

  • You must be an administrator or a member of the Administrators group to change drive properties.
  • The General tab shows the drive label, its type, the file system for which the drive is formatted, its total capacity, how much space on the drive is used, and how much space is free (available). The Security tab shows the access permissions, audit entries, and ownership that has been set for the drive.
  • The Security tab only appears on drives formatted to use NTFS.
  • You can view drive properties on a remote computer or a local computer. To access a remote computer, right-click Computer Management (Local), click Connect to another computer, and then select the computer you want to connect to.


Change a drive label

To change a drive label

  2. In the console tree, click Logical Drives.

    Where?

    • Computer Management (Local)
    • Storage
    • Logical Drives
  3. Right-click the drive that you want to change, and then click Properties.
  4. In Label, type a label for the drive.

Notes

  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings may also prevent you from completing this procedure.
  • On a FAT drive, the drive label must be 11 characters or fewer. On an NTFS drive, the drive label must be 32 characters or fewer.
  • You can change the drive label on a remote computer or a local computer. To access a remote computer, right-click Computer Management (Local), click Connect to another computer, and then select the computer you want to connect to.


Setting up permissions and auditing

You set up permissions and auditing on the Security tab, which you can find by viewing the properties for any drive listed in Logical Drives.

The Security tab gives you control over which permissions you can allow or deny for groups and users. For example, you can let one user read the contents of a drive, let another user make changes to the drive, and prevent all other users from accessing files and folders on the drive.

You set up auditing to detect and record security-related events, such as when a user attempts to access a confidential file or folder. When you audit a drive, an entry is written to the Windows 2000 security log whenever the drive is accessed in a certain way. Using the Security tab, you determine which objects to audit, whose actions to audit, and exactly what types of actions are audited.

You can change security settings only on computers for which you are an administrator. In addition, you can only change security settings on drives formatted to use NTFS.


Set access permissions on drives

To set access permissions on drives

  2. In the console tree, click Logical Drives.

    Where?

    • Computer Management (Local)
    • Storage
    • Logical Drives
  3. Right-click the drive for which you want to set access permissions, click Properties, and then click the Security tab.
  4. Do one of the following:
    • To set access permissions for a new user or group, click Add. In Look in, choose the domain of which the user or group is a member. In Name, type the name of the user or group you want to set permissions for, click Add, and then click OK to close the dialog box.
    • To remove an existing user or group from the permissions list, click the name of the user or group, click Remove, and then click OK. Skip step 5.
  5. In Permissions click Allow or Deny for each access permission you want to allow or deny.

Notes

  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings may also prevent you from completing this procedure.
  • You can only change access permissions on drives formatted to use NTFS.
  • Users and groups granted Full Control for a drive can delete files and folders on the drive, regardless of the access permissions protecting the individual files and folders on the drive.
  • Logical Drives will only let you set permissions on the root directory of a drive; however, inheritance of permissions is supported so folders and files below the root directory may inherit the permissions you set.
  • You can change access permissions on a remote computer or a local computer. To access a remote computer, right-click Computer Management (Local), click Connect to another computer, and then select the computer you want to connect to.


Permissions for drives

Drive permissions include Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write. Each of these permissions consists of a logical group of special permissions. The following table lists each drive permission and specifies which special permissions are associated with that permission.

Special Permissions | Full Control | Modify | Read & Execute | List Folder Contents | Read | Write
Traverse Folder/Execute File | x | x | x | x |  |
List Folder/Read Data | x | x | x | x | x |
Read Attributes | x | x | x | x | x |
Read Extended Attributes | x | x | x | x | x |
Create Files/Write Data | x | x |  |  |  | x
Create Folders/Append Data | x | x |  |  |  | x
Write Attributes | x | x |  |  |  | x
Write Extended Attributes | x | x |  |  |  | x
Delete Subfolders and Files | x |  |  |  |  |
Delete | x | x |  |  |  |
Read Permissions | x | x | x | x | x | x
Change Permissions | x |  |  |  |  |
Take Ownership | x |  |  |  |  |
Synchronize | x | x | x | x | x | x

Notes

  • Although List Folder Contents and Read & Execute appear to have the same special permissions, these permissions are inherited differently. List Folder Contents is inherited by folders but not files. Read & Execute is inherited by both files and folders.
  • For information on setting permissions, and descriptions of each special permission, see Related Topics.


Set audit entries on drives

To set audit entries on drives

  2. In the console tree, click Logical Drives.

    Where?

    • Computer Management (Local)
    • Storage
    • Logical Drives
  3. Right-click the drive you want to audit, click Properties, and then click the Security tab.
  4. Click Advanced, and then click the Auditing tab.
  5. Do one of the following:
    • To set audit entries for a new user or group, click Add. In Look in, choose the domain of which the user or group is a member. In Name, type the name of the user or group you want to set entries for, and then click OK to open the Audit Entry dialog box.
    • To change audit entries for an existing user or group, click the name of the user or group, and then click View/Edit.
    • To remove audit entries for an existing user or group, click the name, and then click Remove. Skip steps 6, 7, and 8.
  6. In the Audit Entry dialog box, select where you want auditing to take place in Apply onto, if necessary.
  7. In Access, click Successful, Failed, or both for each access you want to audit.
  8. If you want to prevent files and folders from inheriting these audit entries, select the Apply these auditing entries to objects and/or containers within this container only check box.

Important

  • Before Windows 2000 will audit access to files and folders, you must use Group Policy to enable the Audit Object Access setting in the Audit Policy. If you do not, you receive an error message when you set up auditing for files and folders, and files or folders will not be audited. Once auditing is enabled in Group Policy, use Event Viewer to review successful or failed attempts to access the audited files and folders.

Notes

  • You can set or change audit entries only on computers for which you are an administrator or have been granted the Manage auditing and security log right in Group Policy.
  • You can only change audit entries on drives formatted to use NTFS.
  • Once you enable auditing, you can use Event Viewer to review the Security Log, which contains your audit information.
  • You can change audit entries on a remote computer or a local computer. To access a remote computer, right-click Computer Management (Local), click Connect to another computer, and then select the computer you want to connect to.


Set ownership on drives

To set ownership on drives

  2. In the console tree, click Logical Drives.

    Where?

    • Computer Management (Local)
    • Storage
    • Logical Drives
  3. Right-click the drive for which you want to set ownership, click Properties, and then click the Security tab.
  4. Click Advanced, and then click the Owners tab.
  5. Click the new owner, and then click OK.

Notes

  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings may also prevent you from completing this procedure.
  • You can only change ownership on drives formatted to use NTFS.
  • You can change ownership settings on a remote computer or a local computer. To access a remote computer, right-click Computer Management (Local), click Connect to another computer, and then select the computer you want to connect to.
  • Logical Drives only changes ownership of the drive, not the folders and files on the drive.


Set special permissions on drives

To set special permissions on drives

  2. In the console tree, click Logical Drives.

    Where?

    • Computer Management (Local)
    • Storage
    • Logical Drives
  3. Right-click the drive for which you want to set special permissions, click Properties, and then click the Security tab.
  4. Click Advanced, and then do one of the following:
    • To set special permissions for a new user or group, click Add. In Look in, choose the domain of which the user or group is a member. In Name, type the name of the user or group you want to set special permissions for, and then click OK to open the Permission Entry for dialog box.
    • To view or change special permissions for an existing user or group, click the name of the group or user, and then click View/Edit.
    • To remove a user or group and its special permissions, click the name of the user or group, and then click Remove. Skip steps 5, 6, and 7.
  5. In the Permission Entry for dialog box, click where you want the permissions applied in Apply onto, if necessary.
  6. In Permissions, click Allow or Deny for each permission.
  7. If you want to prevent subfolders and files within the tree from inheriting these permissions, click to select the Apply these permissions to objects and/or containers within this container only check box.

Notes

  • You can change special permissions only on computers for which you are an administrator. In addition, you can only change security settings on drives formatted to use NTFS.
  • You can change special permissions on a remote computer or a local computer. To access a remote computer, right-click Computer Management (Local), click Connect to another computer, and then select the computer you want to connect to.
  • Users and groups granted Full Control for a drive can delete files and folders on the drive regardless of the access permissions protecting the files and folders on the drive.
  • Logical Drives will only let you set permissions on the root directory of a drive; however, inheritance of permissions is supported so folders and files below the root directory may inherit the permissions you set. To prevent this inheritance, you must select the Apply these permissions to objects and/or containers within this container only check box. Doing this will set permissions for files and folders in the root directory of the drive, but not on the files and folders below the root directory.


Special permissions overview

You can set any or all of the following special permissions on drives:

Traverse Folder/Execute File

Traverse Folder allows or denies moving through folders which the user does not have permission to access in order to reach files or folders that the user does have permission to access (applies to folders only). Traverse folder takes effect only when the group or user is not granted the Bypass traverse checking user right in Group Policy. (By default, the Everyone group is given the Bypass traverse checking user right.)

Setting the Traverse Folder permission on a folder does not automatically set the Execute File permission on all files within that folder.

Execute File allows or denies running program files (applies to files only).

List Folder/Read Data

List Folder allows or denies viewing file names and subfolder names within the folder (applies to folders only).

Read Data allows or denies viewing data in files (applies to files only).

Read Attributes

Allows or denies viewing the attributes of a file or folder, such as read-only and hidden. Attributes are defined by NTFS.

Read Extended Attributes

Allows or denies viewing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary.

Create Files/Write Data

Create Files allows or denies creating files within the folder (applies to folders only).

Write Data allows or denies making changes to the file and overwriting existing content (applies to files only).

Create Folders/Append Data

Create Folders allows or denies creating folders within a folder (applies to folders only).

Append Data allows or denies making changes to the end of the file but not changing, deleting, or overwriting existing data (applies to files only).

Write Attributes

Allows or denies changing the attributes of a file or folder, such as read-only or hidden. Attributes are defined by NTFS.

Write Extended Attributes

Allows or denies changing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary.

Delete Subfolders and Files

Allows or denies deleting subfolders and files, even if the Delete permission has not been granted on the subfolder or file.

Delete

Allows or denies deleting the file or folder. If you don't have Delete permission on a file or folder, you can still delete it if you have been granted the Delete Subfolders and Files permission on the parent folder.

Read Permissions

Allows or denies reading permissions for the file or folder, such as Full Control, Read, and Write.

Change Permissions

Allows or denies changing permissions for the file or folder, such as Full Control, Read, and Write.

Take Ownership

Allows or denies taking ownership of the file or folder. The owner of a file or folder can always change permissions on it, regardless of any existing permissions that protect the file or folder.

Synchronize

Allows or denies different threads to wait on the handle for the file or folder and synchronize with another thread that may signal it. This permission applies only to multithreaded, multiprocess programs.