How do I Deny Change without Denying Read on Windows File Share Permissions?


I have a Windows 2012 R2 server. I would like to create a file share that is read-only to a group when accessed from the network (via the file share) but writable when the members of the group are connected via Remote Desktop.

I thought I would be able to accomplish this by making the folder writable from file permissions but deny write using the share permissions.

I am unable to set 'Deny Change' without also being forced to 'Deny Read' in the share permissions dialog. (I don't want to deny read...)


Local perms consist of only NTFS perms. Effective share perms are the union of the NTFS perms + the share perms. Just make the share perms read only.

ntfs perms share perms

  • I want other groups to have write access to the file share. By not having Full Control and/or Change allowed will this prevent other groups from writing to the share?
    – Matt Cofer
    Oct 8 '15 at 15:20
  • Then use share perms of Group1=Read, Group2=Write
    – Clayton
    Oct 8 '15 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.