Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a folder which has permissions on it for our IIS user. This folder is currently shared so our code deployment user can move files onto it.

I attempted adding another user to the share through the folder properties>Sharing>Share and added a user there. Then IIS went down so I checked and sure enough it appeared that setting the share permissions removed the local folder permissions for the IIS user.

How do I add a user to the share without removing users from accessing it locally?

share|improve this question

start over and create a local or domain group, and give the access for this new group. Any new users you need to give access to, you can just add them to this group.

share|improve this answer
Good idea - it would have paid to have done it correctly the first time. But is this really the only solution? – Ziplin Apr 1 '11 at 16:13
may be not.. though its really not much of an effort, and I suggest cleaning it up so you dont start looking for solutions again next time another user needs access. – whizkid Apr 1 '11 at 16:21
+1 cause you're definitely right, Whizkid. This is actually the route I went. I think it's still a pretty valid problem to have, so I'm adding a bounty. – Ziplin Apr 6 '11 at 15:50
if you are still looking for a solution here, I would need few more details, like, is the server is domain? are all the users mentioned here are local users (or any domain users)? also, check if you have removed inheritance on the folder – whizkid Apr 11 '11 at 15:04
As far as "best-practices" go... you really should have 2 types of groups. Security Groups (which are used when defining permissions on shares & such) and User Groups (which is where you put the users) If you have 6 shares (1 for accounting, 1 for administration etc...) you create 6 Security Groups (one for each share) For each Dept in your office, you create a "User Group"... and perhaps additional ones for Adminstrators & supervisors. Assign the user to the User Group, put the user groups in security groups, and assign permissions to security groups. – TheCompWiz Apr 12 '11 at 16:37

Not sure exacrtly what you mean by "setting the share permissions removed the local folder permissions for the IIS user" (did the permission disappear, or just not get applied as expected?), but you should understand that Windows applies the most restrictive permission of the NTFS and Share permissions set on the object. Perhaps this explains what you experienced.

The Microsoft Technet article on Share and NTFS permissions in Windows 2008 suggests:

some experienced administrators prefer always to set share permissions to Full Control for Everyone, and to rely entirely on NTFS permissions to restrict access

This seems like a good standard approach to take, and in conjunction with whizkids suggestion to use groups reduces administrative overhead.

share|improve this answer
The permissions actually disappeared, oddly enough – Ziplin Apr 12 '11 at 14:07

That's not expected behavior. I would test a couple other times and see if you can find the pattern. Adding a user through the GUI should never remove another user.

Did you change inheritance, or cleanup a user that had a GUID name, or something else at the same time? Or after creating the share, did you 'move' files over? Moving from the same volume will bring the original permissions with it and will not inherit.

I suspect that some other factor besides the share permission addition caused this to occur.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.