In the past few weeks I was trying to modify the Active Directory and User Group setting in our company. However, due to the lack of the proper documentation, after making the changes unexpected side effects started to pop out.

The last problem I encountered was about network shares.

Since multiple generations of IT guys have worked in this company, each one of them has made changes to the Active Directory, but none of them has done documentation. Hence, the Active Directory and GPOs have grown to the point they have become chaotic. I decided to untangle this mess and started working on it.

The infrastructure

There is one Domain Controller and one Terminal Server. We use Terminal Services. The users connect to the Terminal Server via Remote Desktop Connection and do most of their work there.

The users have access to some network shares, shared from the Domain Controller.

The problem

I'll illustrate the problem via example: User A, is member of Group X. I remove A from group X. Then the user is not able to access a folder shared in the network.

I check the Properties of this folder.

  • Sharing tab --> Advanced Sharing --> Permissions: includes the groups Everyone and Administrators [1]
  • Security tab --> under Groups or Username section, the SYSTEM, Administrators and group X is listed. [2]

So why when I remove user A from group X, A does not access to this shared folder. Isn't user A considered as part of the Everyone user group. Shouldn't he have all the permissions via Everyone group?

To generalize my question. How do Sharing Permissions and Security Permissions cooperate with each other? What are the dependencies between them.

Basically, does this mean that when I want to share a folder with a certain group of users, that group has to be listed both in Shared Permissions [1] and Security Permissions [2]?


Share permissions and NTFS Security Permissions are layered. Users must have access at each layer to gain access to the share.

Share permissions are a legacy concept, so most administrators set them to "Everyone" and handle access control 100% at the NTFS level. This appears to be what is happening here. What you are describing is the expected behavior.

This is explained in the following technet article: Share and NTFS permissions

  • The permissions applied are cumulative (a combination of the share and file permissions (when accessed via a share name) and the most restrictive permissions will end up applying to your users. If the user were accessing the folders/files directly on the server itself the file/folder permissions apply. This link might help explain things technet.microsoft.com/en-us/library/cc754178.aspx – Enigman Aug 29 '14 at 12:15
  • so the "best practice" is to share network folders with Everyone, and then control access rights via the Security tab? – Kristof Tak Aug 29 '14 at 12:26
  • 2
    Yes, that is how it is handled in most organizations – MDMarra Aug 29 '14 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.