Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

An auditor will be visiting our office soon, and they will require read-only access to our data. I have already created a domain user account and placed them into a group called "Auditors".

We have a single fileserver (Windows Server 2008) with about ten shared folders. All of the shares are set up to allow full access to authenticated users, and access restrictions are implemented with NTFS ACL's. Most folders allow full access to the "Domain Users" group, but the auditor won't need to make any changes. It takes several hours to update NTFS ACL's since we have about one million files. Here are the options that I am currently considering.

  • Create a "staff" group to assign read/write instead of "Domain Users" at the share level
  • Create a "staff" group to assign read/write instead of "Domain Users" at the NTFS level
  • Deny access to the "Auditors" group at the share level
  • Deny access to the "Auditors" group at the NTFS level
  • Accept the status quo and trust the auditor.

I will probably need to configure similar users in the future, as some of our contractors require a domain account but shouldn't be able to modify our client data. Is there a best practice for this?

share|improve this question
up vote 6 down vote accepted

Here is what I would do (all at the NTFS Level, leave your share permissions the way they are ):

  1. Create a "ReadOnlyAccess" Group
  2. Add the Auditors group, contrators group, etc to "ReadOnlyAccess"
  3. Create the Staff Group
  4. Remove domain users permissions - you don't want to do it this way anyway
  5. Add the Staff group with the minimum permissions they need to work
  6. Add the ReadOnlyAccess Group with R/O access

You can do steps 4-6 in one shot so it's not multiple acl updates.

Now whenever someone needs R/O access all you have to do add them to the "ReadOnlyAccess" Group no need to update the acls in the future.

share|improve this answer
I like this! It means one extra step when creating new staff accounts, but that's the nature of default deny. :) – Nic Jan 15 '11 at 21:51

Generally for shares I set up a local security group for read only access and another local security group for read/write access. Set the appropriate permissions for these groups with NTFS security (leave share permissions as everyone full for simplicity).

Once you have set up these groups, any new users (or groups) just need to be added into the local security groups to get the correct level of access, no need to change the NTFS permissions each time.

So for your situation I would probably, create a Staff global group with all your standard users as members. Create two domain local groups, LO_SharedFolders_ReadOnly and LO_SharedFolders_ReadWrite and add the Staff group to the ReadWrite group and the Auditors group to the ReadOnly group. Next grant the appropriate NTFS permissions to those folders for the local groups.

Then if you ever want to give some read only access, all you need to do is add them to the appropriate local group.

share|improve this answer
+1 Nice idea! Just as fast as share permissions, but applied through the file system instead. I guess the permissions would be lost if the files were copied to another server, though. – Nic Jan 17 '11 at 20:28
Protip: membership in machine-local groups is determined when the SMB session is established, so it is best to make changes when nobody is connected to the fileserver. – Nic Jan 17 '11 at 20:53
As long as you use domain local groups rather than machine local ones, there is no problem moving to another server. Group membership is determined when the user logs on, so any changes will not take effect if they are currently logged in, but will the next time they log off and on. – Jon Reeves Jan 18 '11 at 21:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.