Share Permissions¶
A shared folder has two sets of permissions: the NTFS permissions on the folder itself, and the share permissions on the network share. Both apply, and the more restrictive one wins. Share permissions are the ones people forget.
See them¶
Get-SmbShare
Get-SmbShareAccess -Name Finance
Name AccountName AccessControlType AccessRight
---- ----------- ----------------- -----------
Finance Everyone Allow Full
GUI: folder → Properties → Sharing → Advanced Sharing → Permissions.
The three share rights¶
| Right | Allows |
|---|---|
| Full Control | Everything, including changing permissions |
| Change | Read, write, delete |
| Read | Read only |
Fix them¶
The common approach: set the share to a group with Change, and let NTFS permissions do the fine control.
Revoke-SmbShareAccess -Name Finance -AccountName Everyone -Force
Grant-SmbShareAccess -Name Finance -AccountName "CORP\Finance" -AccessRight Change -Force
Grant-SmbShareAccess -Name Finance -AccountName "Administrators" -AccessRight Full -Force
Remove shares that shouldn't exist¶
Covered in Shares. Anything not administrative ($) and not required by the README goes.
Verify¶
Get-SmbShare | Where Name -notlike "*$" | ForEach-Object { Get-SmbShareAccess -Name $_.Name }
No Everyone with Full or Change.
Example¶
The Finance share gives Everyone Full. NTFS on C:\Finance gives Users Modify. Together, any account on the network can change any Finance file. Fix both layers: share to Finance group with Change, NTFS to Finance group with Modify, Users removed from both.