Drive Access Permissions in MS-DOS 6.22

This article explains how drive access and file security function within MS-DOS 6.22, addressing whether a system parameter exists to configure local drive access permissions. Because MS-DOS 6.22 was designed as a single-user operating system utilizing the FAT16 file system, standard user-level access permissions do not exist natively. The sections below outline the reality of MS-DOS storage architecture, the parameters often associated with disk control, and the mechanisms available to restrict local data modification.

Native Access Permissions in MS-DOS 6.22

In MS-DOS 6.22, there is no system parameter in CONFIG.SYS or AUTOEXEC.BAT that configures local drive access permissions.

MS-DOS lacks a user account architecture, authentication subsystem, or access control list (ACL) framework. The underlying file system, FAT16 (and FAT12 for floppy disks), stores file allocation tables, directory entries, and file attributes, but does not allocate metadata for user ownership or access rights. Anyone with physical or command-line access to an MS-DOS 6.22 machine automatically has full read, write, and execute control over all connected local drives.

While true permissions do not exist, several native utilities and parameters control how drives and files are handled by the system:

  • The ATTRIB Command: MS-DOS provides basic file-level protection via the ATTRIB command. Setting the Read-Only flag (ATTRIB +R [filename]) prevents accidental modification or deletion of specific files through standard DOS commands. However, any user can remove this attribute at any time using ATTRIB -R.
  • SHARE.EXE: Often mistaken for a permissions utility, SHARE.EXE is a terminate-and-stay-resident (TSR) program that enables file-sharing and record-locking capabilities. It prevents two programs from simultaneously writing to the same portion of a file, but it does not restrict access based on user credentials.
  • DRIVPARM and DRIVER.SYS: Configured within CONFIG.SYS, DRIVPARM defines the physical characteristics of block devices (such as tracks, sectors, and heads). It configures hardware topology rather than access control.
  • LASTDRIVE: Specifies the maximum number of drives that MS-DOS can recognize (from A through Z), but it does not apply security policies to the drives made available.

Securing Local Drives in MS-DOS Environments

Because native parameters cannot restrict drive access, systems requiring local data protection during the MS-DOS 6.22 era relied on non-native solutions:

  • Hardware Write Protection: Setting the physical write-protect tab on 3.5-inch floppy disks or using write-blocking controller hardware on fixed disks to enforce read-only states.
  • Network Redirectors: When using network clients (such as the Microsoft Network Client 3.0 for MS-DOS or Novell NetWare), permissions are enforced on remote network drives by the server, not locally by MS-DOS.
  • Third-Party Security Software: Utilities such as Norton Utilities or proprietary disk-locking TSRs allowed administrators to password-protect entire drives or directories by intercepting BIOS Interrupt 13h or DOS Interrupt 21h calls.