Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a network share that is several levels deep. For one particular folder, I would like to assign different rights than the default access that the shared folder is allowing. However this does not seem possible, as all of the child rights and inherited from the share rights. So if the share rights set the share to read-only can I not override the permissions in a child folder to allow write access?

share|improve this question
What I did was set the share permissions to Read/Write and set the NTFS file system permissions to Read only. This seems to work. The users cannot modify files that they do not have sufficent rights to. – Aaron M Jun 16 '09 at 16:20
up vote 4 down vote accepted

Most Microsoft people will tell you that you should set your permissions correctly at the NTFS level and then open up your shares unless you have some really good reason for doing the permissions at the share level. There is a lot of flexibility in NTFS permissioning that should let you do whatever it is you need to do and having the files RW at the file system level is a big security hole if one of your employees manages to log on locally somehow.

share|improve this answer

No you can't override share permissions.

Share permissions sit on top of the NTFS permissions. You need share and NTFS permission to do anything to a file that is accessed through said share. So it is quite permissible to give "Everyone" full RW access at the share level, and then control what they can actually do at the NTFS level. Which is what you will need to do in this case.

share|improve this answer

That is correct. Share permissions trump any file permissions. This is standard. Most files are RW for Everyone but then restricted at the share level. If the file permissions overrode the share, there would be no point in share permissions.

Your best option is to share the subfolder with it's own share and share permissions and allow users to access it that way.

share|improve this answer

As a best practice, the most efficient way to configure share permissions is with Authenticated Users having Full Control access. Then, the NTFS permissions should configure each group with the required permissions. This provides security for local and network access to the resource. It also provides protection of the resource for when it is backed up and when the resource name is changed or relocated.

To calculate the effective permissions for a user accessing a resource via a share compare the share permissions and the NTFS permissions for the user and use the most restrictive permission. There is no precendence per se except for restrictiveness. Share permissions are not applied if you do not access the file via the share.

If you are using server 2003 SP1 or higher you can alaso use access based enumeration to further secure the resources. See Windows Server 2003 Access-based Enumeration

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.