WIndows file access control

I have a file on a Windows 2003 NTFS file system. It is called C:\MyFolder\MyFile.txt. First grant a user read access to the file. Then I remove the user's read access to the parent folder.

Now the user cannot use Windows Explorer to browse the folder开发者_如何学Python and double click to open in Notepad. The user can go to Start (menu) Run and enter "C:\MyFolder\MyFile.txt" and the file will load in Notepad.

Can someone point me to some MSDN documentation that explains why this is? I've tried all the google and bing queries I can think of.

thanks much

See the 'Traverse Folder' permission in the table on this page:

http://technet.microsoft.com/en-us/library/cc787794(WS.10).aspx

It sounds more like a TechNet article than an MSDN one to me.

If you think about a directory/folder as not a file cabinet folder but rather a index card stuck to the front of the cabinet to say what is in the cabinet. This is effectively what a folder is on the file system (a index to where the files are.)

Because you have denied the user rights to what is in the folder you have denied them access to the index card. However, if they know the precise file they want then they can still access to the file which they have permissions for as this doesn't require a check on the index card.

Behind the scenes it is obviously a little more complicated but that is the basic view. I saw this technique used quite a bit on the *nix environments when I was at Uni to hide previous years assignments from the current batch of students. However, because they hadn't removed permissions from some files the tutors could still direct them to specific examples from previous years.