Designing Shared Folder Permissions on a File Server: Share and NTFS

In many companies, folder permissions have been granted case by case over the years: “Let so-and-so see it too,” “Give the new colleague access to this folder.” The result is a long list of individual names on every folder, and nobody knows which entries are still needed. On the day ransomware or a disgruntled employee gets involved, those excess permissions determine how much of your data is damaged.

Two layers of permissions: Share and NTFS

When a user connects to a folder over the network, Windows checks two sets of permissions:

• Share Permissions: Apply only to network access and have three simple levels: Read, Change and Full Control.
• NTFS Permissions: Defined on the files and folders themselves, apply both over the network and on the server itself, and are far more granular.

A user’s effective network access is the most restrictive of the two. For example, if the Share allows only Read and NTFS allows Modify, the user can only read the files.

A common, simple approach is to grant Authenticated Users Change or Full Control at the Share level and do all real access control with NTFS. Managing permissions in two different places is the source of most confusion.

Grant access to groups, not individuals

1. Create a group for each main folder and each access level, such as FS-Finance-RW for read and write and FS-Finance-RO for read-only.
2. Add only these groups to the folder’s NTFS permissions.
3. Add users to role groups, such as “Finance Staff,” and add the role groups to the access groups.

This is the well-known AGDLP pattern in Active Directory: accounts go into Global groups, Global groups go into Domain Local groups, and permissions are assigned to the Domain Local group. The advantage is that when an employee changes roles, only their group membership changes, and you never have to touch folder settings.

Choose the right access level

• Read & Execute: View and open files, with no ability to change them.
• Modify: Read, create, edit and delete files; enough for most users.
• Full Control: Everything in Modify, plus permission to change permissions and ownership; for system administrators only.

Giving Full Control to regular users means any user can change their colleagues’ permissions or lock others out of a folder.

Folder structure and inheritance

Keep the folder structure shallow and aligned with your company’s departments, and define permissions at the top one or two levels so subfolders inherit them. Disabling inheritance deep in the tree quickly takes control out of your hands. Avoid Deny permissions wherever possible; with a well-designed group structure, you usually won’t need them.

Also enable Access-Based Enumeration on the Share so each user only sees the folders they have access to. This both improves security and makes it easier for users to find their folders.

Review and maintenance tools

• The Effective Access tab in a folder’s security settings shows what access a specific user actually has.
• Before major changes, back up permissions with a command such as icacls D:\Shares /save D:\acl-backup.txt /t so you can restore them with the /restore option if needed.
• Every few months, review access group memberships with each department manager.
• Log deletions and changes to sensitive files with auditing so it’s clear who did what.

Checklist

• The Share is set for Authenticated Users and real control is done with NTFS.
• Permissions are granted only through groups, with no individual names.
• Full Control is reserved for system administrators.
• Inheritance is preserved and Deny is kept to a minimum.
• Access-Based Enumeration is enabled.
• Permissions are backed up and reviewed periodically.

ITPlus724 engineers can review your file server’s current permissions and design and implement a simple, manageable, group-based structure for it.