ASUSTOR - Website Management

Date:

Topic_id:

Subject:

Description:

content:

<h4>COURSE OBJECTIVES</h4>
Upon completion of this course you should be able to:
<ol>
<li>Understand the basic principles of using Windows ACL with your ASUSTOR NAS.</li>
<li>Use Windows ACL to manage data access permissions on your ASUSTOR NAS.</li>
</ol>
 
<h4>PREREQUISITES</h4>
Course Prerequisites:
<a target="_blank" href="https://www.asustor.com/online/College_topic?topic=106" rel="noopener">NAS 106: Using NAS with Microsoft Windows</a>
Students are expected to have a working knowledge of:
Shared Folders, Access Control
 
<h4>OUTLINE</h4>
<a href="#acl1">1. Introduction to Windows ACL</a>
<a href="#acl11">1.1 Do I need to enable Windows ACL?</a>
<a href="#acl2">2. Configuring Windows ACL</a>
<a href="#acl21">2.1 Enabling Windows ACL</a>
<a href="#acl22">2.2 Configuring Windows ACL permissions with ADM File Explorer</a>
<a href="#acl23">2.3 Configuring Windows ACL permissions with Windows Explorer</a>
<a href="#acl24">2.4 Windows ACL permission rules and precautions</a>
<a href="#acl25">2.5 Moving objects to your NAS while maintaining ACL permissions</a>
 <hr /> 
<h4><a name="acl1"></a>1. Introduction to Windows ACL</h4>
Windows ACL is the 13 different types of file permissions designed by Microsoft for NTFS file systems which can be applied to specific users and groups. Within this type of infrastructure, administrators can make more detailed and precise access permission configurations.
Furthermore, in the Windows AD domain infrastructure (widely used by businesses), Windows ACL permissions can be applied to all users and groups in the domain. Users can use any computer in the network to log in, and as long as they use the same account name, all permissions will remain the same. IT staff will not need to configure permissions for each individual server and PC workstation, significantly increasing management efficiency.
In order to more closely integrate ASUSTOR NAS with AD domains, simplifying IT management and increasing productivity, ASUSTOR has deeply integrated the Windows ACL permissions system with ADM, providing the following unique features:
<ol>
<li>The ability to enable Windows ACL for individual shared folders.</li>
<li>Comprehensive support for all 13 types of Windows ACL permissions.</li>
<li>Ability to view Windows ACL effective permissions in detail from within ADM.</li>
<li>Support for network users and groups.</li>
<li>Ability to apply ACL permissions to Samba, File Explorer, AFP, FTP, WebDAV, Rsync file transfer protocols.</li>
</ol>
 
<a name="acl11"></a>1.1 Do I need to enable Windows ACL?
As described in the previous section, Windows ACL provides up to 13 different permission settings that can be applied to all users and groups on the NAS and on the domain (if the NAS has been added to a Windows AD domain). In the event of improper planning or configuration of permissions, there is the possibility that all users will not be able to access a certain folder or file. Obviously, this type of error can be resolved by using an administrator account, but the amount of wasted time from when the problem first occurs to when it gets resolved can be seen as a significant intangible cost to businesses.
ASUSTOR NAS was developed based on the Linux operating system, so ADM’s native settings utilize the Linux permission management mechanism:
<ul>
<li>Applicable permissions: RW (Read & Write), RO (Read Only), DA (Deny Access)</li>
<li>Permissions may be applied to: “Owner”, the group that the owner is a part of and “Other”.</li>
</ul>
The smaller number of options allows for simpler configuration. However, the flexibility and adjustability of the permissions is very limited. For example, when using the Linux permissions mechanism, it is not possible to give a user the ability to edit a file while not giving them permission to delete the file.
If you are only using your NAS between yourself and a limited number of family and friends, then it is recommended that you use ADM’s original permissions management mechanism. However, if your NAS is being used for business data storage, it is suggested you first consult with your IT staff to decide if it is appropriate to enable Windows ACL permissions and then complete a permissions deployment plan should you decide to use it.
We have provided the flexibility for you to enable or disable Windows ACL for single shared folders, which is very helpful for assessment and planning. You can create a shared folder for testing, enable Windows ACL and then configure permissions settings. Afterwards you can check if the results are what you expected them to be. Once you get the results that you require you can then apply the settings to the shared folder of your choice. This allows you to avoid any mistakes or errors in planning that could deny access to important data, affecting the operation of your business.
 
<h4><a name="acl2"></a>2. Configuring Windows ACL</h4>
 
<a name="acl21"></a>2.1 Enabling Windows ACL
 
 Creating a new shared folder:
<ul>
<li>Log into your ADM with an administrator account using your web browser.</li>
<li>Select Shared Folders inside Access Control.</li>
<li>Click Add.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240124150415_worm_shared_folder_add.png" alt="" width="900" height="540" />
 
<ul>
<li>Enter a name for the new folder and then click [Next].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523160658_ACL_create_shared_folder_s2.png" alt="" width="660" height="566" />
 
<ul>
<li>After setting the access rights for the shared folder, select [Enable Windows ACL] and then click [Next].
 Note: Shared folder access rights are the first layer of permissions checking. If a user or group has not been assigned “Read & Write” permissions here, any Windows ACL permissions assigned to them will be blocked. Therefore, it is recommended that you configure more lenient access rights for shared folders that have Windows ACL enabled and then use Windows ACL to further configure more specific permissions later.
</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523160757_ACL_create_shared_folder_s3.png" alt="" width="660" height="566" />
 
<ul>
<li>Select [Skip] and then click [Next].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523160830_ACL_create_shared_folder_s4.png" alt="" width="660" height="566" />
 
<ul>
<li>Confirm your settings and then click [Finish].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523160914_ACL_create_shared_folder_s5.png" alt="" width="660" height="566" />
 
 Enabling Windows ACL for already existing shared folders:
<ul>
<li>Select Shared Folders inside Access Control.</li>
<li>Select the shared folder that you wish to enable Windows ACL for, and then click [Edit].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523160943_ACL_edit_shared_folder_s1.png" alt="" width="900" height="540" title="" align="" />
 
<ul>
<li>Select [Windows ACL].</li>
<li>Select [Enable Windows ACL] and then click [Close].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523161114_ACL_edit_shared_folder_s2.png" alt="" width="600" height="574" />
<div class="alert alert-info">
<h3>About Windows ACL</h3>
<ol>
<li>After enabling Windows ACL for a shared folder, the shared folder and all subfolders and files contained within it can be assigned user or group permissions.</li>
<li>The following shared folders do not support Windows ACL permissions: Home, User Homes, PhotoGallery, Web, Surveillance, MyArchive, Network Recycle Bin, virtual devices, external devices (USB hard drives, optical drives).</li>
<li>After enabling Windows ACL you will be able to use ADM’s File Explorer or Microsoft Windows Explorer to configure permissions. After disabling Windows ACL you will only be able to configure permissions from within ADM's File Explorer.</li>
<li>If you enable Windows ACL and then later decide to disable it, all file and folders will be re-assigned with Read & Write permissions for all users.</li>
<li>No matter if you are using Windows ACL or not, users will still require shared folder and file permissions in order to access files.</li>
</ol>
</div>
 
<a name="acl22"></a>2.2 Configuring Windows ACL permissions with ADM File Explorer
 
<ul>
<li>From the ADM desktop, select [File Explorer].</li>
<li>Select a shared folder (or subfolder or file) that you have enabled Windows ACL for. Right-click on the shared folder and then select [Properties].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523161157_ACL_File_explorer_property_s1.png" alt="" width="900" height="517" title="" align="" />
 
<ul>
<li>Select the [Permission] tab. Here you will be able to see the currently configured permissions for the folder. You can also manage permissions for the folder here.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523161226_ACL_File_explorer_property_add_s1.png" alt="" width="750" height="544" />
 
After enabling windows ACL for a shared folder, the system by default will assign "Read & Write, but cannot Delete" permissions to "Everyone", "administrators" and the "admin" account. These permissions will be applied to the shared folder only and will not be inherited by objects below. These default permissions can be modified by using the [Edit] or [Remove] buttons.
 Note: An individual file or folder can utilize up to a maximum of 250 Windows ACL permissions (including inherited permissions).
 
<ul>
<li>Include inheritable permissions from this object’s parent: This option is enabled by default. The system will automatically configure sub folders and files to inherit permissions from the object above it. Disabling this option will reject all inheritable permissions and only keep newly added permissions.</li>
<li>Replace all child object permissions with inheritable permissions from this object: Enabling this option will replace all subfolder and file permissions with ones from the parent object.</li>
</ul>
 
The management functions that you will be able to use here are as follows:
 Add:
<ul>
<li>Click on the [Add] button to create a new permission for the object.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523161226_ACL_File_explorer_property_add_s1.png" alt="" width="750" height="544" />
 
<ul>
<li>User or group: Specify the user or group you want to apply the permission to.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523161428_ACL_File_explorer_property_add_s2.png" alt="" width="500" height="581" />
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523161534_ACL_File_explorer_property_add_s3.png" alt="" width="500" height="581" />
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523161557_ACL_File_explorer_property_add_s4.png" alt="" width="500" height="581" />
 
<ul>
<li>Type: Select [Allow] or [Deny] to grant or deny the permission to the user or group.</li>
<li>Apply To: This option will only appear when adding permissions to a folder. From the drop down menu, you can select where the permission will be applied. The way in which the permission will be applied will be determined by whether or not you select the [Apply these permissions to objects and/or containers within the container only] checkbox.</li>
<li>Apply these permissions to objects and/or containers within the container only: 
<ul>
<li>When the option is unchecked:
<table class="table table-striped table-bordered" style="width: 100%; text-align: center;">
<tbody>
<tr>
<th style="background: Silver; text-align: center;">Apply To</th>
<th style="background: Silver; text-align: center;">Apply permission to current folder</th>
<th style="background: Silver; text-align: center;">Apply permission to subfolders within the current folder</th>
<th style="background: Silver; text-align: center;">Apply permission to files within the current folder</th>
<th style="background: Silver; text-align: center;">Apply permission to all subsequent subfolders</th>
<th style="background: Silver; text-align: center;">Apply permission to files within all subsequent sub folders</th>
</tr>
</tbody>
<tbody>
<tr>
<th>This folder only</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>This folder, subfolders and files</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>This folder and subfolders</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>This folder and files</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>Subfolders and files only</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>Subfolders only</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>Files only</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody>
</table>
</li>
<li>When the option is checked:
<table class="table table-striped table-bordered" style="width: 100%; text-align: center;">
<tbody>
<tr>
<th style="background: Silver; text-align: center;">Apply To</th>
<th style="background: Silver; text-align: center;">Apply permission to current folder</th>
<th style="background: Silver; text-align: center;">Apply permission to subfolders within the current folder</th>
<th style="background: Silver; text-align: center;">Apply permission to files within the current folder</th>
<th style="background: Silver; text-align: center;">Apply permission to all subsequent subfolders</th>
<th style="background: Silver; text-align: center;">Apply permission to files within all subsequent sub folders</th>
</tr>
</tbody>
<tbody>
<tr>
<th>This folder only</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>This folder, subfolders and files</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>This folder and subfolders</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>This folder and files</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>Subfolders and files only</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>Subfolders only</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<th>Files only</th>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody>
</table>
</li>
</ul>
</li>
</ul>
 
<div class="alert alert-info">
<h4>The 13 types of Windows ACL permissions are described below:</h4>
<ul>
<li>Traverse folder/execute file: Traverse Folder allows or denies moving through folders to reach other files or folders, even if the user has no permissions for the traversed folders (applies to folders only). Execute File allows or denies running program files (applies to files only).</li>
<li>List folder/read data: List Folder allows or denies viewing file names and subfolder names within the folder (applies to folders only). Read Data allows or denies viewing data in files (applies to files only).</li>
<li>Read attributes: Allows or denies viewing the attributes of a file or folder, such as read-only, hidden, compressed and encrypted.</li>
<li>Read extended attributes: Allows or denies viewing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary by program.</li>
<li>Create files/write data: Create Files allows or denies creating files within the folder (applies to folders only). Write Data allows or denies making changes to the file and overwriting existing content (applies to files only).</li>
<li>Create folders/append data: Create Folders allows or denies creating folders within the folder (applies to folders only). Append Data allows or denies making changes to the end of the file but not changing, deleting, or overwriting existing data (applies to files only).</li>
<li>Write attributes: Allows or denies changing the attributes of a file or folder.</li>
<li>Write extended attributes: Allows or denies changing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary by program.</li>
<li>Delete subfolders and files: Allows or denies deleting subfolders and files, even if the Delete permission has not been granted on the subfolder or file (applies to folders).</li>
<li>Delete: Allows or denies deleting the file or folder.</li>
<li>Read permissions: Allows or denies reading permissions of the file or folder.</li>
<li>Change permissions: Allows or denies changing permissions of the file or folder.</li>
<li>Take ownership: Allows or denies taking ownership of the file or folder. The owner of a file or folder can always change permissions on it, regardless of any existing permissions that protect the file or folder.</li>
</ul>
</div>
 
 Edit:
<ul>
<li>Selecting a permission and then clicking on the [Edit] button will allow you to modify the permission.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523162604_ACL_File_explorer_property_add_s5.png" alt="" width="750" height="544" />
 
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523162652_ACL_File_explorer_property_edit_s1.png" alt="" width="500" height="581" />
 
 Remove:
<ul>
<li>Selecting a permission and then clicking on [Remove] will remove the permission from the current object.</li>
</ul>
 
 Effective Permissions:
<ul>
<li>Clicking on the [Effective Permissions] button and then selecting a user from the list will allow you to view the user’s effective permissions with regards to the specified folder or file. Effective permissions are determined from the combination of Windows ACL permissions and shared folder access rights.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523162813_ACL_File_explorer_property_effective_s1.png" alt="" width="700" height="533" />
 
<a name="acl23"></a>2.3 Configuring Windows ACL permissions with Windows Explorer
First, use a Windows administrator account to map a Windows ACL enabled shared folder as a network drive. For more information, please see <a target="_blank" href="https://www.asustor.com/online/College_topic?topic=106" rel="noopener">NAS 106: Using NAS with Microsoft Windows</a>.
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523162845_Win_explorer_map_network_drive_S.png" alt="" width="600" height="496" />
 
<ul>
<li>Right-click on any file or subfolder within the shared folder and then select [Properties].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523170537_Win_explorer_ACL_property_s1.png" alt="" width="900" height="503" />
 
<ul>
<li>Select the [Security] tab. Here, you will be able to see a list of users and groups and their ACL permissions for the file or subfolder.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523163511_Win_explorer_ACL_property_s2.png" alt="" width="400" height="570" />
 
If an object simultaneously has inherited permissions from its parent and also explicit permissions, the inherited permissions will be checked in grey while the explicit permissions will be checked in black.
 
<ul>
<li>Click on [Edit] [Add].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523163748_Win_explorer_ACL_property_edit_add.png" alt="" width="800" height="571" />
 
<ul>
<li>In the [From this location:] field you should see the following information:
<ul>
<li>If the NAS has been added to a Windows AD domain you will see the AD domain name.</li>
<li>If the NAS has not been added to a Windows AD domain, you will see the NAS’s IP address.</li>
</ul>
</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523164555_Win_explorer_ACL_property_edit_add_s1.png" alt="" width="500" height="281" />
 
<ul>
<li>In the [Enter the object names to select] field, enter the following information:
<ul>
<li>If the NAS has been added to a Windows AD domain, enter the domain user or group name and then click on [Check Names] in order to verify the user/group name. Then, click on [OK].</li>
<li>If the NAS has not been added to a Windows AD domain, enter the ADM local user or group name and then click on [Check Name] in order to verify the user/group name. Then, click on [OK].</li>
</ul>
</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523164624_Win_explorer_ACL_property_edit_add_s2.png" alt="" width="500" height="281" />
 
<ul>
<li>Now, you should be able to see the newly added user or group in [Group or user names:] list. Select the user or group and then use the [Allow] and [Deny] checkboxes to configure their access permissions for the object. Once you are done, click on [Apply].</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523164726_Win_explorer_ACL_property_edit_s1.png" alt="" width="400" height="570" />
 
<a name="acl24"></a>2.4 Windows ACL permission rules and precautions
 
 ACL Conflicting ACL permissions:
<ul>
<li>If you encounter conflicting Windows ACL permissions, the object’s explicit permissions will be given priority. For example, if the user "testuser" inherits [Allow Read & Execute] permissions for a file but the given explicit permissions for the file are [Deny Read & Execute], then "testuser" will not be able to access the file.</li>
<li>Conversely, if "testuser" inherits [Deny Read] permissions but the explicit permission given to the file are [Allow Read], then "testuser" will be able to access the file.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523164835_Win_explorer_ACL_property_conflict_1.png" alt="" width="750" height="571" />
 
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523164943_Win_explorer_ACL_property_conflict_ADM_NO_read.png" alt="" width="900" height="518" />
 
 Rules for moving files and folders:
<table class="table table-striped table-bordered" style="width: 100%; text-align: center;">
<tbody>
<tr>
<th colspan="2" style="background: Silver; text-align: center;"></th>
<th style="background: Silver; text-align: center;">Copy</th>
<th style="background: Silver; text-align: center;">Move</th>
</tr>
</tbody>
<tbody>
<tr>
<th rowspan="2" style="background: DarkCyan; color: white;">Moving within the same shared folder</th>
<th style="background: DarkCyan; color: white;">A1. ACL Disabled</th>
<td style="text-align: left;">Retain existing permissions</td>
<td style="text-align: left;">Retain existing permissions</td>
</tr>
<tr>
<th style="background: DarkCyan; color: white;">A2. ACL Enabled</th>
<td style="text-align: left;">
<ul>
<li>Remove ACL permissions inherited from source folder</li>
<li>Remove explicit ACL permissions</li>
<li>Apply ACL permissions inherited from destination folder</li>
</ul>
</td>
<td style="text-align: left;">
<ul>
<li>Remove ACL permissions inherited from source folder</li>
<li>Retain explicit ACL permissions</li>
<li>Apply ACL permissions inherited from destination folder</li>
</ul>
</td>
</tr>
<tr>
<th rowspan="4" style="background: SteelBlue; color: white;">Moving between different shared folders</th>
<th style="background: SteelBlue; color: white;">B1. ACL Disabled ACL Disabled</th>
<td style="text-align: left;">Retain existing permissions</td>
<td style="text-align: left;">Retain existing permissions</td>
</tr>
<tr>
<th style="background: SteelBlue; color: white;">B2. ACL Disabled ACL Enabled</th>
<td style="text-align: left;">Apply ACL permissions inherited from destination folder</td>
<td style="text-align: left;">Apply ACL permissions inherited from destination folder</td>
</tr>
<tr>
<th style="background: SteelBlue; color: white;">B3. ACL Enabled ACL Disabled</th>
<td style="text-align: left;">
<ul>
<li>Remove all ACL permissions</li>
<li>Permissions will be reset as "Full access for all users"</li>
</ul>
</td>
<td style="text-align: left;">
<ul>
<li>Remove all ACL permissions</li>
<li>Permissions will be reset as "Full access for all users"</li>
</ul>
</td>
</tr>
<tr>
<th style="background: SteelBlue; color: white;">B4. ACL Enabled ACL Enabled</th>
<td style="text-align: left;">
<ul>
<li>Remove ACL permissions inherited from source folder</li>
<li>Remove explicit ACL permissions</li>
<li>Apply ACL permissions inherited from destination folder</li>
</ul>
</td>
<td style="text-align: left;">
<ul>
<li>Remove ACL permissions inherited from source folder</li>
<li>Remove explicit ACL permissions</li>
<li>Apply ACL permissions inherited from destination folder</li>
</ul>
</td>
</tr>
</tbody>
</table>
 
 Exceptions: When data is deleted from an ACL enabled shared folder and moved to the Network Recycle Bin the rules from "B3" in the chart above will not apply. This is to prevent the situation where files with [Deny Access] permissions are deleted and moved to the Network Recycle Bin and then become fully accessible to all users. Taking privacy and security into consideration, files from ACL enabled folders that are moved to the Network Recycle Bin will be assigned the permission [Read & Write for Owners, Deny Access for all Other Users].
 
 File deletion permissions:
There are 2 permissions associated with deleting files:
<ol>
<li>User has explicit "Delete" permission for the file.</li>
<li>User has "Delete subfolders and files" permission for the file's parent folder.</li>
</ol>
 If any of the above permissions are configured as "Deny", then the user will not be able to delete the file. Only if neither of the above permissions has been configured as "Deny" and at least one of them has been configured as "Allow", will the user be able to delete the file.
 
 Access Right of objects:
After Windows ACL has been enabled for a shared folder, each object (subfolders and files) contained within the folder will have an access right.
<ul>
<li>You can view access right for an object by selecting it from ADM File Explorer, right-clicking on it and then selecting [Properties]. There will be editing link in the [Share Folder Access Rights] section of the [General] tab.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523165034_ACL_File_explorer_property_gereral_1.png" alt="" width="750" height="544" />
 
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523165323_ACL_File_explorer_property_gereral_2.png" alt="" width="900" height="540" />
 
 Person who have access right will be able to configure ACL permissions for it. For example, the admin in the graphic above, is the owner of the "ACL_Test" folder. Therefore, admin will be able to configure ACL permissions for the folder and the subfolder and files contained within it. For every newly added object, the creator of the object will be set as the access rights by default. Additionally, users in the administrator group will have the ability to modify the access rights. For example, if we wanted to transfer ownership of the "ACL_Test" folder in the graphic above to other users (i.e., testuser), admin and all users in the administrator group would have the ability to transfer ownership. Once testuser becomes an owner of the "ACL_Test" folder, she will be able to reconfigure permissions for its subfolders and files even if she did not originally have access permissions for them.
 
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523165345_ACL_File_explorer_property_gereral_3.png" alt="" width="700" height="527" />
 
<a name="acl25"></a>2.5 Moving objects to your NAS while maintaining ACL permissions
When all Windows PCs and NAS devices in a network environment have been added to the same Windows AD domain, all user accounts and permissions on the domain can be combined together. However, when moving files or folders from a PC server to a NAS, existing ACL permissions will not be retained (using the rules in previous section). This causes IT staff to have to reconfigure permissions.
If you wish to maintain existing ACL permissions when moving files or folders to your NAS, you can utilize <a href="https://fastcopy.jp" target="_blank" rel="noopener">Fastcopy</a>, a 3rd party software. In the example below, we will demonstrate how to use this Fastcopy.
 
<ul>
<li>First, use a Windows administrator account to map a Windows ACL enabled shared folder as a network drive. For more information, please see <a target="_blank" href="https://www.asustor.com/online/College_topic?topic=106" rel="noopener">NAS 106: Using NAS with Microsoft Windows</a>.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523162845_Win_explorer_map_network_drive_S.png" alt="" width="600" height="496" />
 
<ul>
<li>Open Fastcopy.</li>
<li>[Source]: Specify the source folder here.</li>
<li>[DestDir]: Specify the destination folder here. (the network drive mapped in previous step)</li>
<li>Select the [ACL] checkbox to ensure that Fastcopy will retain the original ACL permissions of your files when moving them.</li>
<li>Click on [Execute] to begin moving the folder.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523170011_Win_ACL_fastcopy_1.png" alt="" width="400" height="492" />
 
<ul>
<li>After the folder has been moved successfully, all data moved to the destination will have retained their ACL permissions from the source (including all explicit and inherited permissions). This data will not inherit any permissions from the parent object at the source.</li>
</ul>
<img src="https://www.asustor.com/images/tinymce/upload_img_20240523170048_Win_ACL_fastcopy_2.png" alt="" width="400" height="540" /> <img src="https://www.asustor.com/images/tinymce/upload_img_20240523170103_Win_ACL_fastcopy_3.png" alt="" width="400" height="510" />

Publish: