Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Thanks for reading.

I have a share on a 2003 server that I would like to share with some of my domain users.

The share is currently empty, so n worries about permissions of subfiles/folders.

I have set it up with permissions as follows:

AccessGroup - Full permissions.
AccessGroup - Full shared permissions.
No other permissions defined at all.

I have added the users to the AccessGroup, but they can't enter the share across the network - it says access denied.

What am I missing here? Am I not understanding permissions, or do I need to flush something or...?


Edit Thanks for the comment. No, I am just testing it across the network myself from another workstation. Do I need to log out of my local workstation for changes on the server properties to take effect?

share|improve this question
You mention, that you added users to the group. Have they logged out and in again since you made the change? – Zoredache Dec 7 '10 at 23:52
@zoredache - See Edit. – Eli Dec 8 '10 at 0:00
@Eli: Yes, you need to log off and back on to "refresh" your group membership. – joeqwerty Dec 8 '10 at 0:04
See this. – Zoredache Dec 8 '10 at 0:08
Hmm. No luck. I tried the method on that page, and klist ran as expected, but no luck with share access. – Eli Dec 8 '10 at 0:19

You've got two sets of permissions to worry about-- the underlying NTFS filesystem permissions (accessible via the "Security" tab of the "Properties" sheets of the shared folder) and the "Share Permissions" (accessible in Windows Server 2003 from the "Permissions..." button on the "Sharing" tab of the "Properties" sheets of the shared folder).

I'd recommend granting access via NTFS permissions only and leaving "Share Permissions" set to "Everyone / Full Control". The most restrictive combination of both permissions applies, but there's no advantage to setting restrictive permissions in both. (The "Share Permissions" comes from a time when the underlying filesystem might be one that doesn't have any permissions, like FAT.)

I'd set "SYSTEM / Full Control", "Administrators / Full Control", and "AccessGroup / Modify" (unless you need members of "AccessGroup" to be able to set permissions, in which case I'd give them "Full Control".)

Once you've done that you should see users who are members of the "AccessGroup" group as being able to access the share and read, write, and modify files and folders there.

share|improve this answer
Thanks for the answer. Unfortunately, that is basically what I have. Sharing permissions are full for Authenticated Users, and NTFS are full control for AccessGroup only. Still, people in the access group get permission denied when they try to access it. It really seems like it should be working. – Eli Dec 9 '10 at 1:52

Go to Properties of folder, go to security tab and assign a permission as required to user. This should resolve your issue.

Good Luck :)

share|improve this answer
No, assigning permissions using groups is perfectly acceptable and some would say the only sane way to go about it. – ThatGraemeGuy Dec 8 '10 at 15:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.