We have recently gotten a new system delivered to us. It's a standard Server 2008 and Windows 7 server-client solution with some tightened security. One of the new security policies have caused a little ruckus among us administrators.
The written policy stipulates that when sharing a resource (file or something) we must now set security on both NTFS and the share. To the best of my knowledge (and my colleagues) Microsoft best practices says that you share a resource to Everyone with full access and then you set the security on the resource itself. This how we've done it since the days of NT 4.
We feel that this new policy has been written by someone who doesn't really grasp how Windows permissions work. Some who thinks that sharing to Everyone is a major security hole, even though NTFS should suffice. We haven't been able to get a straight answer so I ask here. Are we wrong in our assumption that permissions set on the NTFS level is perfectly sufficient?