In a Windows NTFS only environment, if I wanted to use NTFS alone to share folders on a LAN, could I do that?
None of the results I found seem to address this question. Microsoft's documentation does not address the question either - From Share and NTFS Permissions on a File Server (emphasis mine):
Access to a folder on a file server can be determined through two sets of permission entries: the share permissions set on a folder and the NTFS permissions set on the folder (which can also be set on files). Share permissions are often used for managing computers with FAT32 file systems, or other computers that do not use the NTFS file system.
Share permissions and NTFS permissions are independent in the sense that neither changes the other. The final access permissions on a shared folder are determined by taking into consideration both the share permission and the NTFS permission entries. The more restrictive permissions are then applied.
The sentences in bold are confusing. For instance, if
Share permissions are often used for managing computers with FAT32 file systems does this not imply that, in a NTFS-only environment, I don't need Share permissions and I can rely on NTFS permissions only?
A similar question was posted on TechNet 8 years ago but most answers just revert to the Microsoft document above, with the exception of one answer, which seems to suggest it is possible to use NTFS only:
With ntfs permissions you need to know the path to the directory and have rights to that directory. Please also note with a standard windows server install all server drives have a default administrative share (c$, d$,e$ etc). So for example for a secure security model i would do the following:
- Delete all administrative shares (c$, d$ etc.)
- Remove everyone from the directories with user data
- Now go back and set ntfs security for the directories in concern (more complicated than stated here)
- Map drive letters on user workstations using login scripts or group policies.
Now users have access to their appropriate directories on the server but cannot browse the server for share names.
The problem is, that answer does not detail how to go about "using login scripts or group policies", exactly .