I have been reading some articles about file sharing permissions. In most of the articles it states that the easiest way to manage share and NTFS permissions is to grant everyone full access and then use NTFS to further restrict permissions.

My only question is...

What happens if a user is in the everone group but not in the NTFS security group. Will that user have full control?



There are 2 different aspects of accessing files on a share.

The share itself (which is like a door), and the files behind it, which is like the room.

By setting accessrights to the share itself, you only set permissions if a user can go through the door or not. In the past, this was the only way to set access to files on a network and for the sake of backwards compatibility, this was never removed.

For that reason, it is indeed common practice to give the Everyone group Full Control on the share itself.

When you then set access rights in the Security tab, you control access per file or per folder inside the share. For example, you can specify that a user can go through the door and reach the room behind it and the user only has permission to sit at table 2 and 3 (aka different folders controlled by either security groups or the user has permission set on the folder directly.

So if you give the Everyone group full control on the share, but you set NTFS security group rights, the user can still be denied.

If however you set the Everyone group in the security settings alongside with an NTFS security group, everyone has full control and the security group is ignored.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.