Windows Server File Share Permissions: NTFS and Network Access
On a network share, share permissions work with NTFS permissions to control who can use shared files. For network access, Windows applies the more restrictive result of the two permission systems. Share permissions can't grant more access than NTFS permissions allow.
The practical approach is to assign access through security groups in Active Directory, use NTFS to set folder-level rights, and review effective access when users report a problem. First, understand what each permission layer controls.
Key takeaways
- Share permissions apply only when someone connects over the network. NTFS permissions apply to both network and local access.
- When a person accesses a network share, Windows applies the more restrictive permission allowed by the share and NTFS settings.
- Share permissions offer Read, Change, and Full Control. NTFS offers six basic levels, from Read to Full control.
- Active Directory security groups make access easier to maintain than individual user entries.
- Nested group membership, inherited permissions, and Deny entries can lead to access that's hard to explain.
How share permissions and NTFS permissions differ
Share permissions control the network doorway
Share permissions apply when a user reaches a folder through a network path, such as \\FileServer\Departments
. They don't apply when someone signs in to the file server and opens the folder locally.
This distinction matters when troubleshooting. A user might be able to open a folder at the server console but receive an access error from a mapped drive. The network connection adds the share permission layer, while the local path does not.
NTFS permissions control the folder and its contents
NTFS permissions are set on files and folders stored on an NTFS volume. They apply to local access and network access, and they can be assigned at different folder levels.
For a network connection, both systems matter. Windows evaluates the user's access under the share permissions and NTFS permissions, then enforces the more restrictive result. A permissive setting at one layer cannot cancel a restriction at the other.
Permission levels and the more restrictive rule
Share and NTFS permissions use different levels. The table shows the basic options administrators commonly choose.
| Permission system | Basic level | General access |
|---|---|---|
| Share | Read | View files and folders |
| Share | Change | Read, create, modify, and delete files |
| Share | Full Control | Change access plus manage permissions at the share level |
| NTFS | Full control | Read, write, modify, delete, and change permissions |
| NTFS | Modify | Read, write, and delete, without changing permissions |
| NTFS | Read & execute | View and run files, and traverse folders |
| NTFS | List folder contents | View names of files and subfolders |
| NTFS | Read | View file contents and attributes |
| NTFS | Write | Create files and folders, and write data |
Two examples of effective network access
If the share permission is Read and the NTFS permission is Full Control , the user gets Read access over the network. The share limits what the user can do.
If the share permission is Full Control and NTFS is Read , the user still gets only Read access. NTFS is the limiting layer. This is why administrators should assess both sets of permissions rather than relying on the share setting alone.
Full Control at the share level doesn't override a restrictive NTFS entry. However, it can make a mistake in NTFS permissions more serious, so broad share access still needs a deliberate policy.
Configure a Windows file share
Set share permissions
Use these steps to create or update share access:
- Right-click the folder and select Properties .
- Open the Sharing tab, then choose Advanced Sharing .
- Check Share this folder and enter a share name.
- Select Permissions . If the Everyone group appears, remove it and add the intended users or security groups. Use Authenticated Users only when broad access is explicitly intended.
- Assign the required share level, then apply the changes.
Removing Everyone isn't a substitute for adding the right groups. Make sure the intended users retain the access they need before closing the dialog. The share name becomes part of the path users enter, such as \\FileServer\Departments
.
Set NTFS permissions on the Security tab
In the folder's Properties dialog, open the Security tab and select Edit . Add the appropriate security groups from Active Directory, then assign the needed NTFS level.
Check the folder's child items as well. Permissions on the top-level folder may flow to files and subfolders through inheritance. If a subfolder needs a different audience, review how inherited entries and its own entries combine before changing access.
Hide a share name from browsing
Adding a dollar sign to the end of the share name creates a hidden share, such as Projects$
. Users can reach it by typing the full path, for example \\FileServer\Projects$
, but it won't appear in ordinary network browsing.
A hidden share isn't a security boundary. Anyone who knows the path still needs valid share and NTFS permissions, and those permissions must be set as carefully as they would be for a visible share.
Choose share settings that support least privilege
Broad share access can work, but it isn't a rule
Some guidance recommends setting the share to Full Control and enforcing restrictions through NTFS. Netwrix recommends Full Control for Authenticated Users, while tenfold recommends Full Control for administrators and Change for domain users.
These are different approaches, not a universal requirement. A broad share setting can simplify administration because NTFS controls the effective file access. However, it leaves less room for error if someone later grants excessive NTFS access. In organizations that need tighter control at both layers, limit share access to the groups that need the share.
Use groups to manage routine access
Assign folder permissions to Active Directory security groups instead of individual user accounts. For example, grant the Finance group Modify access to its working folder and give a reporting group Read access to completed reports.
Group-based assignments are easier to review when employees change roles or leave. Direct entries for individual accounts can persist after an account is deleted, leaving an orphaned security identifier in the access control list. Keep group membership aligned with job duties, and use a small number of administrators to manage access.
Troubleshoot denied or excessive access
Check group membership, Deny entries, and inheritance
When a user has more access than expected, inspect nested group membership. A person can receive permissions through a group that belongs to another group, even when their direct account entry looks limited. Review the groups assigned to the folder and the user's full group membership.
Deny entries can block access granted elsewhere, so use them sparingly. A Deny entry may also make troubleshooting harder when several groups and folders are involved. Inheritance needs the same care: inherited entries remain part of a child folder's permissions unless inheritance is changed and the inherited entries are removed or converted.
If a folder has a distinct access purpose, administrators can disable inheritance and convert inherited entries to explicit permissions. That creates a clear starting point, but it also means the folder's access may no longer follow future changes to its parent. Document why inheritance was changed and who owns the exception.
Reduce unnecessary folder exposure
Access-based enumeration can hide folders from users who don't have permission to view them. For example, a user without access to a folder named 2023_Restructuring
won't see its name when browsing the share.
This reduces casual exposure of folder names, but it does not replace correct permissions. Users still need appropriate access controls on the folder and its files.
Verify effective access and review changes
When access is disputed, check the user's permissions on the exact folder or file and trace every group that grants access. Compare the share permissions with the NTFS entries, then inspect inherited and explicit entries. This reveals whether access comes from the share, a group, or a parent folder.
Also test the path the user actually uses. Local access to the server and a network connection to \\FileServer\Share
don't evaluate the same permission layers. Record important permission changes and keep auditing enabled for file server access changes. A separate administrator account, used only for administrative work, helps keep routine activity distinct from privileged changes. Just-in-time access can further limit how long an administrator has elevated rights.
For files that need controlled access outside a traditional file server, see our guide to secure file sharing for small businesses.
Frequently asked questions
Which permission wins when share and NTFS settings conflict?
For network access, Windows enforces the more restrictive result. Share Read with NTFS Full Control gives the user Read access. Share Full Control with NTFS Read also gives the user Read access.
Should share permissions always be set to Full Control?
No. Some administrators use broad share permissions and enforce restrictions through NTFS, while others limit the share to specific groups. Choose a model your team can review and maintain, and avoid assuming Full Control is safe if NTFS permissions are not carefully managed.
Why can a user have more access than the folder seems to allow?
The user may be in a nested Active Directory group that has broader rights. Inherited permissions from a parent folder can also grant access. Check group membership and all effective entries, not only the user's direct assignment.
Does a hidden share prevent unauthorized access?
No. A dollar sign hides the share from routine browsing, but anyone with its path can attempt to connect. Share and NTFS permissions still determine whether access is allowed.
Keep file access clear and reviewable
Windows Server file share permissions are easiest to manage when each layer has a clear job. Share settings control network access, while NTFS permissions define what users can do with the folder and its contents.
Use groups, limit access to what each role needs, and investigate nested memberships and inheritance when permissions seem wrong. A permission setup that is simple to explain is also easier to maintain as staff and business needs change.