Section 2: Sharing Permissions

The Big Picture: A Second Door for Network Visitors

So far we looked at permissions on the disk. But a folder can also be shared so that other computers can reach it across the network. A shared folder has a second guest list, just for people who arrive over the network.

Think of a flat in a building:

• The share permissions are the front gate of the building, checked only for visitors coming from the street.
• The NTFS permissions are the lock on your flat door, checked for everyone, including people already inside.

  Another PC                                   This PC
  ┌─────────┐   network    ┌───────────────┐    ┌───────────────┐
  │  Alice  │ ───────────► │ Share         │ ─► │ NTFS          │ ─► file
  │         │              │ permissions   │    │ permissions   │
  └─────────┘              └───────────────┘    └───────────────┘
                              gate 1               gate 2

  Someone sitting at this PC:     (skips gate 1)   ─► NTFS ─► file

New words used here:

• Share: a folder made visible to the network under a name, like \\MYPC\Photos.
• SMB (Server Message Block): the file-sharing language Windows PCs use over the network. When you open \\MYPC\Photos, your PC speaks SMB to the other one.

2.1 Network Share-Level Permissions

What it is: Share permissions are rules attached to the share itself, not to the files. They are checked only when someone connects over the network (SMB). If you sit at the PC and open the same folder locally, share permissions do not apply.

There are only three levels:

Compare this with Section 1: share permissions are much coarser. There is no "Modify" or "special" level here. For fine control, use NTFS.

How to share a folder (File Explorer): Right-click the folder → Properties → Sharing tab. The Share button gives a simple wizard. Advanced Sharing lets you set the share name and the Permissions button, which opens the share permission list.

Default share permission (a modern note). When you create a share with Advanced Sharing, the default is usually Everyone: Read. The simple Share wizard instead sets both the share and NTFS rules for the people you pick.

Command-line view (safe, read-only):

(Get-SmbShare and related commands may need an elevated (administrator) PowerShell on some PCs. If you get "access denied", open PowerShell as administrator.)

Hidden administrative shares. Run net share on a normal Windows PC and you will see names ending in $:

The $ at the end makes the share hidden from casual browsing. Windows creates these automatically, mainly for remote administration. Only administrators can use them. You should know they exist; you do not need to change them.

2.2 Interaction with NTFS Permissions (Most Restrictive Wins)

What it is: When someone connects over the network, both lists are checked: the share permission and the NTFS permission. Windows works out the result of each list, then gives the person the more restrictive of the two.

The rule in one line: Over the network, you get only what both gates allow. In other words, the smaller of the two.

Steps Windows follows:

1. Work out your share permission  (combine all your groups; Deny wins)
2. Work out your NTFS permission   (combine all your groups; Deny wins)
3. Final = whichever is MORE restrictive

Examples:

At the PC itself (local logon, or Remote Desktop), only NTFS applies. So "Read" on the share but "Modify" in NTFS means: Read for network users, Modify for a person sitting at the PC.

A simple, popular design. Because both lists apply, many administrators set the share to a loose level (for example Change or Full Control for Authenticated Users) and then control access in detail with NTFS. They do this because NTFS works for both local and network users, and one detailed list is easier to keep correct than two.

Why Deny and share rules can confuse people. Suppose a user cannot save a file in a shared folder. Check both places:

1. Share permissions (the Sharing tab → Advanced Sharing → Permissions)
2. NTFS permissions (the Security tab)

If either one says no, the answer is no.

Windows tip: The Chapter 19 NTFS rules and these share rules together are why a mapped network drive can behave differently from the same folder opened locally. Always ask: "Am I coming in over the network or sitting at the PC?"

Summary