2

I have a folder on Windows Server 2008R2 Enterprise machine which I have shared as - SharedName - Resources

There are two options to share this folder -
Share...
Advanced Sharing...

enter image description here

I chose 'Advanced Sharing...' because I wanted to give a different Share Name.
I also give 'Read+Change' permission to a particular user say, Niki
Then, I click Ok to save those permission under 'Advanced Sharing...'

Now when I click 'Share...', I don't see 'Niki' user.

Questions -

  • Do I need to add 'Niki' user again if I already gave Shared permission to this user under Advanced option?
  • 'Share...' dialogue has 'Read/Write' permissions and
    'Advanced Share...' dialogue has 'Read/Change/Full Control' permissions.
    How these two sets of permissions relate to each other?
  • Is it a good idea to give different shared name than actual folder name.?
    I like this but have a feeling that someone looking at this shared name on another server won't have any clue about actual folder name. Any thoughts?
1
  • You set Folder Sharing through the Sharing tab (Advanced Sharing is the one you want) and NTFS permissions through the Security tab. The relationship between Share and NTFS permissions is described here: technet.microsoft.com/en-us/library/cc754178.aspx – ErikE Aug 6 '15 at 12:59
1

Since it's a server, you should probably stick with Advanced Sharing. Actually you can completely disable Sharing Wizard via Control Panel -> Folder Options -> uncheck Use Sharing Wizard.

Re. permissions, the usual best practice is to manage permissions via NTFS Access Control Lists (Security tab -> Advanced button -> Permissions tab). Between NTFS permissions and sharing permissions the most restrictive takes precedence, whichever it may be. If you have ACLs populated correctly, sharing permissions can be set to Everyone/Full Control for simplicity's sake - it won't matter.

Speaking, of file system permissions, you probably want to grant them to security groups rather than individual users, especially if your server is a part of a domain. In the long run it'll help you to keep track of who can access what.

Finally, sharing a folder under a different name is perfectly OK. The command to list network shares is net share - it outputs share names and folder paths.


To wrap it up, what you really want to do is to get yourself a nice long book like "Mastering Microsoft Windows Server 2008 R2" or "Windows Server 2008 R2 Unleashed" which will contain exhaustive answers to most of your basic questions. )

5
  • File system permissions (NTFS permissions) do not override sharing permissions. The most restrictive of the two takes precedence, whichever it may be. – ErikE Aug 6 '15 at 12:53
  • You're right of course. ) What I meant to say is that in everyday practice NTFS permissions end up being more restrictive and thus take precedence. Edited my answer for clarity. – Alexander Obersht Aug 6 '15 at 13:18
  • Hi Alex, Thanks a lot for your reply. Can you please elaborate this statement bit more - 'Since it's a server, you should probably stick with Advanced Sharing'. – iniki Aug 12 '15 at 10:49
  • I have learned from other resources that when security is a concern, always use Advanced Sharing. – iniki Aug 12 '15 at 12:01
  • @inki The alternative (Sharing Wizard) is aimed mostly at home users. Enterprise uses Advanced Sharing which allows the administrators to set fine-grained permissions. Hence my "since it's a server" (implying "a file server") remark. – Alexander Obersht Aug 12 '15 at 15:46
1

Share Permission are, well, permissions for the share when accessed over the network. You also got NTFS permissions within the Security tab. These permissions are independent from each other but, and that's the trick, the final access permissions are determined by taking both share and NTFS permissions into consideration. The more restrictive permissions are applied. There are several best practices how to handle shared folders, I'm naming only a few regarding your questions:

  • Keep it simple
  • Don't assign permissions to users. Use groups instead.
  • Don't use "deny" permissions. If access is not explicitly granted, you don't have access, there is no need for "deny permissions".
  • Don't use the "Everyone" group on share permissions, if everyone needs access use "Authenticated Users"

So, a common practice would be: User Niki wants read access. Put Niki in a group "Share_X_Read_Access". Grant "read" access for this group on the share level and "read, execute, modify" on NTFS permissions. You use share permissions to give a somehow loose access and then tighten/give more granular access with NTFS permissions.

There is also a best practice guide from Microsoft.

4
  • Advanced Sharing is for setting share permissions, as the name implies. NTFS permissions are set through the Security tab. – ErikE Aug 6 '15 at 12:52
  • You are right. Confused this with the Properties dialogue in Computer Management - Shared Folders. Edited my answer. Thx. – duenni Aug 6 '15 at 13:10
  • Put Niki in a group "Share_X_Read_Access". Grant "read" access for this group on the share level and "read, execute, modify" on Advanced Sharing. I think you mean '"read, execute" on Advanced sharing'.. – GregL Aug 6 '15 at 13:25
  • I mean NTFS permissions. – duenni Aug 6 '15 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.