This section will be of interest to an administrator who is familiar with security settings on a FAT32 volume where permissions for a shared folder are the only permissions protecting files and subfolders in the shared folder.
When using share permissions and NTFS permissions together, if there is a conflict in the configuration, the most restrictive permission prevails. For example, if a user has NTFS full access to a specific file in a folder that is not shared, the user cannot access the file from the network. In this case, the user can sit down at the computer that contains the file, log in and access the file, because sharing permissions do not affect local access.
One strategy for providing access to resources on an NTFS volume is to share folders with the default shared folder permissions and then control access to shared folders by assigning NTFS permissions. When you share a folder on an NTFS volume, both shared folder permissions and NTFS permissions combine to secure file resources.
Shared folder permissions provide limited security for resources. You gain the greatest flexibility by using NTFS permissions to control access to shared folders. Also, NTFS permissions apply whether the resource is accessed locally or over the network.
When you use shared folder permissions on an NTFS volume, the following rules apply:
You can apply NTFS permissions to files and subfolders in the shared folder. You can apply different NTFS permissions to each file and subfolder that a shared folder contains.
In addition to shared folder permissions, users must have NTFS permissions for the files and subfolders that shared folders contain to gain access to those files and subfolders.
When you combine shared folder permissions and NTFS permissions, the more restrictive permission is always the overriding permission.
Planning
The first step is planning how folders will be shared. To do this, make a list of what data will be stored and what user groups will require access. For example, types of data may be employee data, customer account status data, customer service data, management guideline data, and so on. Groups of users may be managers, administrators, sales reps, customer service reps, and so on.
Create a table with three columns:
- Column 1 displays each data folder by name and location
- Column 2 displays the shared folder name
- Column 3 displays the name of the user group with assigned folder permissions
- File and Printer Sharing for Microsoft Networks
To share any folders or other network objects, you must have "File and Printer Sharing for Microsoft Networks" as a networking component in your local area connection.
To add this component:
In the Windows System Tray, right-click the Local Area Connection icon and choose Status from the context menu. The Local Area Connection Status dialog box appears.
Click Properties. The Local Area Connection Properties dialog box appears.
To add the File and Printer Sharing for Microsoft Networks check box, click Install… and choose it from the Services category.
Select the File and Printer Sharing for Microsoft Networks check box and click OK.
Both share and NTFS permissions serve the same purpose within Windows environments; namely, to help you prevent unauthorized access to your critical folders. However, there are some critical differences between the two that will determine which one you use.
In this blog we will learn about what share permissions and NTFS permissions are, what the differences between the two are, and the best practices for using them.
What Are Share Permissions?
Simply put, share permissions allow you to control who accesses folders over the network (they will not apply to those users who are accessing locally). In share permissions, you cannot control access to individual subfolders or objects on a share. Instead, share permissions apply to all of the files and folders within the share. Share permissions can be used with NTFS, FAT, and FAT32 file systems and allow you to determine the number of users who can access the shared folder.
Share Permission Types
- Full Control: Allows users to create, read, update and delete files and folders in a directory, as well as NTFS files and folders. By default, the “Administrators” group is granted “Full Control” permissions.
- Change: Allows users to read files, as well as add, edit and delete files and folders. “Change” permissions are not assigned by default.
- Read: Allows users to read content in files and folders, as well as execute programs. The “Everyone” group is assigned “Read” permissions by default.
What Are NTFS Permissions?
New Technology File System (NTFS) is used to manage data stored on NTFS file systems and is the de facto file system for Windows NT and later operating systems. Unlike share permissions, NTFS permissions affect both network and local users. The types of NTFS permissions available are similar to share permissions but go into a bit more detail.
The basic types of access permissions for NTFS are Full Control, Modify, Read & Execute, Read and Write. Most of these are self-explanatory, and similar to share permissions. Read & Execute rights allow users to run executables, including scripts. The basic types of access permissions are described in more detail below.
NTFS Permission Types
- Full Control: Allows users to create, read, write, edit and delete files, folders and sub-folders. Users can also change the permissions for all files and folders in a directory.
- Modify: Allows users to modify and delete the files, file properties and folders in a directory.
- Read & execute: Allows users to read files and run executables, including scripts.
- List folder contents: Allows users to view a list of all files, folders and sub-folders in a directory. They can also view folder attributes and permissions, and even execute files, but they cannot view file contents.
- Read: Allows users to read files, file properties and folders in a directory.
- Write: Allows users to write to a file and add files to directories.
Differences Between NTFS and Share Permissions
The type of permissions you choose to use will depend on what you’re looking to achieve and the resources you have available to you. Before deciding which permissions to use, there are a number of important differences between NTFS and Share permissions that you should be aware of. These differences are described below;
- NTFS permissions provide more granular control over shared folders and their contents than Share permissions
- When Share and NTFS permissions are used together, the most restrictive permissions are chosen by default. For example, if NTFS permissions are set to “Everyone Modify Allow”, and Share permissions are set to “Everyone Read Allow”, the Share permissions will override the NTFS permissions as they are more restrictive.
- Unlike NTFS permissions, Share permissions can be applied to FAT and FAT32 file systems.
- Unlike Share permissions, NTFS permissions apply to users who are logged on to the server locally.
- , Unlike NTFS permissions, share permissions allow you to restrict the number of concurrent connections to a shared folder.
- Share and NTFS permissions are configured in different locations. Share permissions are configured in the “Advanced Sharing” properties in the “Permissions” settings, while NTFS permissions are configured on the Security tab in the file or folder properties.
Best Practices for Using Permissions
Your entire objective when using permissions should be to operate on a policy of least privilege, where users only have access to the files and folders they need to do their job. To help achieve this, there are a number of things you can do:
- Don’t assign permissions to user accounts: Permissions should be assigned only to groups in order to simplify the management of access to shared resources. If an employee in your organization changes roles and requires a new set of permissions, you can simply remove them and add them to the most appropriate groups.
- Use the Administrators group wisely: Users in this group will be able to do anything with your files and folders, including changing permissions. There are very few users who warrant this kind of control, and those that do need to be audited and monitored closely. You should use a third-party File Server audit solution to audit, monitor, and alert on changes administrators are making to your files and folders.
- Group objects together depending on security requirements: If there is a load of folders that apply to one particular department in the organization, group them into a parent folder and share that parent folder. This will save you from having to go through and share each folder individually.
How To Manage Permissions
If you find working with two separate sets of permissions too difficult to manage, you are probably better off using only NTFS permissions, as the added granularity will provide more flexibility and thus better security. Not only that, but NTFS permissions can be applied whether the resource is accessed locally or over the network. To use NTFS permissions by default, simply change the Share permissions for the folder to “Full Control.” That way, any changes you make to NTFS permissions will override the Share permissions.
If you want to get the NTFS permissions reports using PowerShell, please check this article.
If you want to better understand the permissions and privileges in your organization and ensure that you are operating on a principle of least privilege, see how Lepide File Server Auditor can help you.