I have been trying to learn Windows shares on an Active Directory domain with Windows 10 machines.

By configuring sharing and security permissions, I find that these permissions are somewhat duplicate?

E.g. without "Change" sharing permission, it doesn't matter whether the user has "Write" or "Modify" security permissions?

E.g. with "Read" sharing permission, but without "Read" or "List folder contents" security permissions, nothing can be read from the share?

Why have two lists with somewhat duplicate permissions?

Sharing permissions:

enter image description here

Security permissions:

enter image description here

  • One applies only to file shares. I’m not sure what you’re expecting. Your question body is more along the lines of “why have two lists”. If that is your question, you should perhaps clarify and then update the title. – Daniel B Jul 15 '18 at 10:19
  • Yes, I dont understand why we have two lists with somewhat duplicate permissions. – Shuzheng Jul 15 '18 at 10:35
  • 2

TL;DR: Share permissions are a mostly legacy feature meant to provide access control for file systems that do not provide their own permissions mechanism. They are more simple and offer less granular permissions than that of modern file systems.

The "Security" permissions you refer to are a property of the filesystem where the data lives. When these permissions are set, an entry is made on the disk hosting the data. As a result, the permissions follow the data, even if the disk is moved to another computer.

Share permissions are a property of the computer's Server service and are independent of the underlying filesystem hosting the data.

The difference becomes relevant when one considers that not all filesystem provide a built-in mechanism for access control. One example is the FAT32 filesystem; if the data you wish to share is stored on a disk with this filesystem type, then the only permissions you have at your disposal are the Share permissions.

This makes sense when one realizes that Share permissions predate the use of filesystems such as NTFS which include their own security mechanism.

In many environments, Share and Filesystem permissions are indeed redundant and most admins will grant Everyone Full Control in the Share permissions, effectively turning them off. Note that if permissions are specified for both mechanisms, Windows applies the most restrictive resulting permissions to the access attempt.

Interestingly, there are in some cases where using the two permission mechanisms together can still be useful. One example is when one wishes to prevent users from leveraging their ownership right to change permissions on files over the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.