Architecture of File Shares in Windows - How resultant permissions are determined for a user ( or a group) towards a file share?

Sourav 20

Hello All,

Just want to know do NTFS and Share permissions sum up when trying to access a file share?

If so, please state the possible NTFS( File permissions) permissions and Share permissions combinations for which the resultant will be no access or access denied?

User's image

2 answers

MotoX80 34,686 Reputation points

2024-11-22T13:34:30.6266667+00:00

The share permissions act as a filter to the file/folder permissions. Let's say that on the share you have defined "everyone read" and no other ACL's. It won't matter what update permissions you have defined on the files/folders, no account will be able to update anything through that share. Only read requests can "get through" the share permissions.

You would need to use the Effective Access tab on the Advanced Security Settings of a shared folder to select a given user and view their access.

Here is the analysis for TestUser. Both the file and share permissions are blocking the user from updating files.
Please sign in to rate this answer.
Sourav 20 Reputation points

2024-11-23T05:15:03.1166667+00:00

Thanks for the clarification.

Actually I was working on assigning privileges to an AD group to a file share. At the NTFS Level the group was having the below permissions

At the share level , Full control is given to everyone

But the resultant of these two comes out as below

Any idea as how is this happening

MotoX80 34,686 Reputation points

2024-11-23T13:27:49.2066667+00:00

Check User rights assignment and see if everyone is listed in Access this computer from the network.

Instead of everyone, try using Authenticated Users.

Sourav 20 Reputation points

2024-11-23T15:30:09.3933333+00:00

Actually the shares are hosted on netapp and the share in use is a domain based DFS share

MotoX80 34,686 Reputation points

2024-11-23T16:25:44.1266667+00:00

I have no idea how that might work. Did you try "Authenticated Users" instead of everyone?

Check AD group policy in the domain and see if "Access this computer from the network" is defined anywhere.

It's been a while since I played with DFS, so please excuse me on this.

Can you reference the individual server shares instead of the domain DFS name? That is, \\LDN-SVR-01\Tools in the image on this page.

https://learn.microsoft.com/en-us/windows-server/storage/dfs-namespaces/dfs-overview

One thought would be to define a different DFS share but have it hosted only on Windows servers. If that works, then it would seem to point to the Netapp as the root of your problem.

Or maybe something in access based enumeration? Or another advanced setting in the DFS Management mmc snapin?

https://learn.microsoft.com/en-us/windows-server/storage/dfs-namespaces/enable-access-based-enumeration-on-a-namespace

Have you tried the dfsdiag tool?

https://techcommunity.microsoft.com/blog/askds/common-dfsn-configuration-mistakes-and-oversights/400058

I no longer have access to an Active Directory domain, so I am unable to test any of this.

Sourav 20 Reputation points

2024-11-24T03:52:45.1566667+00:00

Thanks for the suggestions. Will try out the solutions mentioned and let you know the results

Sourav 20 Reputation points

2024-11-24T03:55:04.6666667+00:00

I cannot add the 'Authenticated Users' group since it will provide access to all the users who don't even use that particular. I mean , it will provide access to all of the users within the domain and my intended audience is for 5-10 users who require the acess

MotoX80 34,686 Reputation points

2024-11-24T13:31:10.4566667+00:00

No, to the share permissions. Replace everyone with authenticated users.

In the image that you posted, it shows that full control and take ownership are limited by file permissions. That matches the NTFS permissions is the other image. So it would appear that effective permissions is getting the correct group to analyze.

That says that for whatever reason, your AD group is not considered part of everyone, or it is, and everyone has not been granted access to this computer from the network.

As I recall, everyone also includes the guest account, so one possibility is that some admin might have changed something to block "everyone" access.

Run 3 more checks of effective access. Set the share permissions to authenticated users, YourDomain\Domain Users, and finally explicitly grant YourDomain\Your AD Group to the share permissions and see if Share still shows up in "Access limited by".

MotoX80 34,686 Reputation points

2024-11-24T14:01:44.5133333+00:00

What account have you been running the effective access test against? If it's the AD group, then select an individual user who is a member of that group.

Another thought is to run the effective access test, "select a user", using other groups and users. Pick an account that is NOT one of your 5-10 users or AD group.

The effective access result should show that access is correctly limited by the file permissions because you never granted access. But what you really want to see is if that account is limited by the share permissions.

If you find another group that can get through the share, then compare the group types and scope.

https://theitbros.com/active-directory-groups/

Sourav 20 Reputation points

2024-11-25T05:49:09.37+00:00

I ran a check on the list of users which were added to the particular group for which I had checked the resultant permissions earlier and was not having access. Now instead I checked the access for the users individually and found that the users are having the required set of access which had assigned to the group. The group consisting the same set of users is not having the access while the individual users are having access . Also from Active directory I have checked that the AD group and the individual users are located in different OUs. Maybe GPOs are here coming into play. I am checking on that.

Please do let me know your suggestions here

MotoX80 34,686 Reputation points

2024-11-25T13:04:23.72+00:00

Run the effective access test for different AD groups. They should be blocked by the file permissions, but you really want to see if they can get through the share permissions.

The group you are using isn't a distribution list, is it? See the link in my previous comment.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Zunhui Han 2,550 Reputation points Microsoft Vendor

2024-11-22T15:04:25.51+00:00

Hello,

Thank you for posting in Q&A forum.

When sharing permissions and NTFS permissions are set the same, such as when the Everyone group has read permissions, the two permissions do not affect each other. When two permissions conflict due to different Settings, the stricter permissions will be used. For example, if the share permission is read and the NTFS permission is write, the final permission will be denied completely because the combined permission of the two permissions is the intersection of the two permissions. If their permissions conflict, the denied permission takes precedence. I suggest you refer to the following links:

https://www.permissionsreporter.com/ntfs-permissions

Best regards

Zunhui

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.
Sourav 20 Reputation points

2024-11-23T05:15:25.6333333+00:00

Thanks for the clarification.

Actually I was working on assigning privileges to an AD group to a file share. At the NTFS Level the group was having the below permissions At the share level , Full control is given to everyone

But the resultant of these two comes out as below

Any idea as how is this happening
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Architecture of File Shares in Windows - How resultant permissions are determined for a user ( or a group) towards a file share?

2 answers

Your answer