Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Background

In the past few weeks I was trying to modify the Active Directory and User Group setting in our company. However, due to the lack of the proper documentation, after making the changes unexpected side effects started to pop out.

The last problem I encountered was about network shares.

Since multiple generations of IT guys have worked in this company, each one of them has made changes to the Active Directory, but none of them has done documentation. Hence, the Active Directory and GPOs have grown to the point they have become chaotic. I decided to untangle this mess and started working on it.

The infrastructure

There is one Domain Controller and one Terminal Server. We use Terminal Services. The users connect to the Terminal Server via Remote Desktop Connection and do most of their work there.

The users have access to some network shares, shared from the Domain Controller.

The problem

I'll illustrate the problem via example: User A, is member of Group X. I remove A from group X. Then the user is not able to access a folder shared in the network.

I check the Properties of this folder.

  • Sharing tab --> Advanced Sharing --> Permissions: includes the groups Everyone and Administrators [1]
  • Security tab --> under Groups or Username section, the SYSTEM, Administrators and group X is listed. [2]

So why when I remove user A from group X, A does not access to this shared folder. Isn't user A considered as part of the Everyone user group. Shouldn't he have all the permissions via Everyone group?

To generalize my question. How do Sharing Permissions and Security Permissions cooperate with each other? What are the dependencies between them.

Basically, does this mean that when I want to share a folder with a certain group of users, that group has to be listed both in Shared Permissions [1] and Security Permissions [2]?

share|improve this question
1  
Have a read here on how Share and NTFS permissions work in concert - blogs.msmvps.com/acefekay/2011/02/04/… –  joeqwerty Aug 29 at 14:58

1 Answer 1

up vote 3 down vote accepted

Share permissions and NTFS Security Permissions are layered. Users must have access at each layer to gain access to the share.

Share permissions are a legacy concept, so most administrators set them to "Everyone" and handle access control 100% at the NTFS level. This appears to be what is happening here. What you are describing is the expected behavior.

This is explained in the following technet article: Share and NTFS permissions

share|improve this answer
    
The permissions applied are cumulative (a combination of the share and file permissions (when accessed via a share name) and the most restrictive permissions will end up applying to your users. If the user were accessing the folders/files directly on the server itself the file/folder permissions apply. This link might help explain things technet.microsoft.com/en-us/library/cc754178.aspx –  Enigman Aug 29 at 12:15
    
so the "best practice" is to share network folders with Everyone, and then control access rights via the Security tab? –  Kristof Tak Aug 29 at 12:26
2  
Yes, that is how it is handled in most organizations –  MDMarra Aug 29 at 12:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.