NTFS Explained: Permissions, Journaling and EFS for the A+ Exam

NTFS is the default file system for Windows and the only one that supports its security features. The A+ exam tests it on three fronts: how it compares with FAT32 and exFAT, how permissions work, and the security features that depend on it.

NTFS, FAT32 and exFAT

Feature	NTFS	FAT32	exFAT
Max file size	16 TB+	4 GB	16 EB
Max volume size	256 TB+	32 GB (Windows format)	128 PB
Permissions	Yes	No	No
Encryption (EFS)	Yes	No	No
Journaling	Yes	No	No
Compression	Yes	No	No
macOS support	Read only	Read/write	Read/write

Two exam answers fall out of this table. The 4 GB FAT32 file size limit is why a large video will not copy to a FAT32 drive. And exFAT is the answer for cross-platform external drives with large files, because macOS can write to it while NTFS is read-only on macOS without third-party software.

NTFS permissions versus share permissions

The most testable part of NTFS, and the source of endless real-world confusion.

NTFS permissions apply whether the file is accessed locally or over the network. The standard set is Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write.

Share permissions apply only to network access and are limited to Full Control, Change and Read. Access a file locally and share permissions are irrelevant.

When both apply, the most restrictive wins. Share permission Read plus NTFS Full Control gives Read over the network — and Full Control locally. This is the calculation the exam asks you to perform.

The common practice is to set share permissions to Full Control for Authenticated Users and do all the real access control with NTFS permissions, so there is only one place to reason about.

Deny, and how permissions combine

Explicit Deny overrides Allow. If a user is in two groups and one is denied, the deny wins.

The exception worth knowing: an explicit Allow on the object itself beats an inherited Deny from the parent folder. Explicit permissions take precedence over inherited ones regardless of type.

Otherwise permissions are cumulative across group memberships — a user in two groups receives the union of their allowed permissions.

Inheritance, and moving versus copying

Child objects inherit from their parent folder by default, and inheritance can be broken on a subfolder.

The behaviour that catches people out, and appears regularly in questions:

Copying a file — to anywhere, same volume or not — creates a new object that inherits the destination's permissions.

Moving within the same NTFS volume keeps the original permissions, because nothing is rewritten, only the directory entry changes.

Moving to a different volume is really a copy-then-delete, so the file inherits the destination's permissions.

And moving a file to FAT32 or exFAT strips permissions entirely, because those file systems cannot store them.

EFS and BitLocker

Both require NTFS, and the exam asks you to distinguish them.

EFS — Encrypting File System — encrypts individual files and folders, per user, with the key tied to the user account. Other users, including administrators, cannot read the content. Two warnings: if the user profile or certificate is lost without a backup, the data is unrecoverable, and copying an EFS file to FAT32 or exFAT decrypts it.

BitLocker encrypts the entire volume, typically using the TPM to seal the key to the boot state. It protects against the drive being removed and read elsewhere; it does not protect files from other logged-in users on a running system.

So: EFS protects files from other users; BitLocker protects the drive from physical theft. They address different threats and are often used together.

Journaling and reliability

NTFS journals metadata changes before applying them, so an unexpected shutdown leaves a recoverable state rather than a corrupt volume. chkdsk repairs inconsistencies, and chkdsk /f /r fixes errors and attempts recovery of readable information from bad sectors — a long operation on a large drive.

Other NTFS features worth recognising: volume shadow copy behind Previous Versions and System Restore, disk quotas per user, file compression, symbolic links and junction points, and alternate data streams — which are occasionally abused to hide data, a Security+ crossover point.

What to remember

NTFS supports permissions, EFS, journaling and compression; FAT32 caps files at 4 GB; exFAT is the cross-platform choice for large files. Effective access is the most restrictive of share and NTFS permissions, explicit Deny beats Allow, and explicit beats inherited. Copy inherits destination permissions, move within a volume keeps them. EFS protects files per user, BitLocker protects the whole volume.

Related reading: FAT32 file system · APFS · Data in use