Skip to main content
AD Academy
Back to topics
Day-to-day administration of AD
Beginner13 minLast updated: Topic 2 of 4

NTFS permissions vs Share permissions

Two layers of permissions on a shared folder — and how they intersect.

Not read

What you will learn here

  • NTFS vs Share permissions
  • How the two layers combine
  • How to set up a shared folder properly

Worth reading first:OU, groups and the AGDLP model

When a user accesses a folder over the network, two checks take place: Share permissions (at the sharing level) and NTFS permissions (at the file system level). The result is the more restrictive permission of the two.

  • Share = Full Control for the relevant group, and the real control is done at the NTFS level — this is the accepted practice.
  • NTFS: Read, Write, Modify, Full Control.
  • Inheritance — permissions descend from the parent folder; breaking inheritance creates exceptions that are hard to maintain.
New-SmbShare -Name "Finance" -Path "D:\Shares\Finance" -FullAccess "LAB\DL_FinanceShare_Modify"

$acl = Get-Acl "D:\Shares\Finance"
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
  "LAB\DL_FinanceShare_Modify","Modify","ContainerInherit,ObjectInherit","None","Allow")
$acl.SetAccessRule($rule)
Set-Acl "D:\Shares\Finance" $acl
powershell
Architecture and Theory — Under the Hood

For network access, the more restrictive permission between Share and NTFS applies. For local access, Share is irrelevant.

  • Common method: Share = Everyone / Full Control, with actual control in NTFS.
  • Deny always overrides Allow.
  • Permissions are inherited from the folder, unless Inheritance is disabled.
Practical Configuration (PowerShell / GUI)
New-SmbShare -Name "Finance" -Path "D:\Finance" -FullAccess "Everyone"
icacls D:\Finance /grant "CORP\DL_Finance_RW:(OI)(CI)M"
icacls D:\Finance /inheritance:r
Get-SmbShareAccess -Name Finance
powershell
Troubleshooting and Resolution
  • Access Denied despite permission — Logoff/Logon is required to refresh the token with new groups.

Check yourself

A user got Read on the Share and Modify on NTFS. What will they actually get over the network?

Was this page helpful?

PreviousNext