Skip to main content
Why “traverse folder” and “execute file” is a combined NTFS permission
  1. Posts/

Why “traverse folder” and “execute file” is a combined NTFS permission

Aiden Arnkels-Webb
Author
Aiden Arnkels-Webb
I’m a cybersecurity lead and fractional CISO/CTO helping professional services firms build secure, scalable infrastructure. I share practical solutions and strategic insights on this site—all free, no gatekeeping. For done-with-you or done-for-you implementation, I work with firms through Rootwire.

I’ve been asked why the Advanced Permissions dialogue on NTFS folders lists “Traverse folder / execute file” as one single permission.

On the surface it seems counterintuitive that you’d allow a user to navigate through a folder, or execute its contents.

There’s no official Microsoft documentation on the design decisions, however, from a filesystem perspective, entering a folder is the same as executing or running it. The same is true of 3 classic Unix filesystem flags and permissions, where the “X” flag allows both directory traversal and file execution, while “R” allows reading and “W” allows writing.

Related