Manage Shared Folder and NTFS Permissions in Windows 11

Managing folder access in Windows 11 requires configuring both network share permissions and NTFS security access control lists (ACLs). This guide outlines the essential steps to configure share permissions for network users and fine-tune NTFS security settings to ensure data remains secure, compliant, and properly accessible.

Understanding the Difference: Share vs. NTFS Permissions

When a user accesses a folder over a local network, Windows evaluates two separate sets of permissions:

• Share Permissions: Control access to a folder across the local network. They do not apply to users logging in locally.
• NTFS Security Permissions: Control access both locally and over the network at the file system level.

Rule of Thumb: When both permission types are applied, the most restrictive permission always takes precedence. The standard administrative best practice is to grant broad access (such as Change or Full Control) at the Share level, and apply precise restrictions using NTFS permissions.

Step 1: Configure Network Share Permissions

1. Locate the folder you want to share, right-click it, and select Properties.
2. Go to the Sharing tab and click the Advanced Sharing button.
3. Check the box labeled Share this folder.
4. Click the Permissions button.
5. Select a user or group, or click Add to specify new users/groups.
6. Choose the appropriate permission level:
   • Full Control: Allows users to read, write, modify, and change permissions.
   • Change: Allows users to read, write, create, and delete files/folders.
   • Read: Allows users to view files, subfolders, and run programs.
7. Click Apply, then OK to close the Permissions window.

Step 2: Configure NTFS Security Access Lists (ACLs)

1. In the same folder Properties window, switch to the Security tab.
2. To modify standard permissions, click Edit.
3. Select the user or group from the list, or click Add to search for a specific user or security group.
4. Set the permissions under the Allow or Deny columns:
   • Full control
   • Modify
   • Read & execute
   • List folder contents
   • Read
   • Write
5. Click Apply and OK.

Step 3: Advanced NTFS Configuration (Inheritance and Special Permissions)

For granular control over file ownership and inheritance:

1. On the Security tab, click Advanced.
2. Managing Inheritance:
   • To prevent child folders from inheriting permissions from parent folders, click Disable inheritance, then choose either to convert existing permissions into explicit permissions or remove them entirely.
3. Adding Detailed Rules:
   • Click Add, select a principal (user or group), and choose what the permission applies to (e.g., This folder, subfolders and files).
   • Click Show advanced permissions to set specific rights like Delete subfolders and files, Read attributes, or Take ownership.
4. Check Replace all child object permission entries with inheritable permission entries from this object if you need to propagate changes down the folder tree.
5. Click Apply and OK to enforce the security policy.