File Permissions in Windows 3.11 on Local Disks

Microsoft Windows 3.11 did not offer native local file permissions or user-based access controls for local disk drives. Because the operating system operated as a graphical operating environment on top of MS-DOS, it relied entirely on the underlying FAT (FAT16) file system. Consequently, local data security was non-existent by modern standards, with protection limited solely to basic MS-DOS file attributes and physical access to the machine.

The Role of the FAT16 File System

Windows 3.11 and Windows for Workgroups 3.11 used the standard MS-DOS FAT16 file system for local storage. Unlike modern file systems such as NTFS, FAT16 had no architecture for Access Control Lists (ACLs), user ownership, or discretionary access control. The file system stored only directory entries with basic metadata: filename, creation date and time, file size, starting cluster, and standard attribute flags.

Because the file system had no concept of individual users, every application and user operating locally ran with unrestricted access to read, modify, or delete any file on the hard drive.

Local Protection via File Attributes

The only mechanism Windows 3.11 provided to restrict local file modifications was the inheritance of MS-DOS file attributes. Users could view and modify these attributes using the Windows File Manager or the DOS ATTRIB command. The available attributes were:

• Read-Only (R): Prevented applications from accidentally overwriting or deleting a file without a warning prompt.
• Hidden (H): Hid files from standard directory listings in File Manager unless explicitly enabled in the view settings.
• System (S): Marked files critical to the operating system, warning users before deletion.
• Archive (A): Flagged files that had been modified since the last backup.

These attributes did not provide security. Any user sitting at the machine could easily clear the Read-Only or System flag through File Manager’s file properties dialog or via the MS-DOS prompt, granting them immediate write and deletion permissions.

User Logons and the Network Exception

Windows for Workgroups 3.11 introduced user logon dialogs, leading some users to believe the local machine was secured by a user account. However, this logon was solely for networking purposes—such as mapping shared network drives, using Microsoft Mail, and identifying the machine in a NetBIOS workgroup.

Pressing the "Cancel" button or the Escape key on the logon screen bypassed the prompt entirely and booted the user straight into the Windows Program Manager with full, unrestricted access to the local hard drive.

While Windows 3.11 did allow administrators to establish password-protected share permissions over the network (such as Read-Only or Full Access shares), these protections only applied to remote network requests. They offered zero protection against any user operating directly at the local terminal. True local file permissions only arrived in the consumer and small-business mainstream with the adoption of Windows NT and the NTFS file system.