Combining Permissions

With an NTFS volume, you can utilize both shared folder and NTFS permissions to control access to resources.

Shared folder permissions provide less detailed security than NTFS permissions. They provide no security when shared folders are accessed locally. NTFS permissions apply whether resources are accessed locally or over a network. You have the greatest flexibility when you use NTFS permissions to control access to shared folders. Therefore, one strategy that you could use is to share folders with the default shared folder permissions and then control access by assigning NTFS permissions.

When you use shared folder permissions on an NTFS volume, there are a few rules that you should keep in mind. You can apply NTFS permissions to files and subfolders within a shared folder. The NTFS permissions can be the same for all contents of a shared folder, or you can set specific permissions for individual files and folders. In order to access those files and subfolders, users must have both the appropriate shared folder permissions and NTFS permissions. This is in contrast to FAT volumes, in which shared folder permissions are the only permissions protecting files and subfolders.

When you combine shared folder permissions and NTFS permissions, the most restrictive setting is enforced. For example, suppose a folder named Public contains two files, FileA and FileB. The Users group has the shared folder Full Control permission for the Public folder. This group also has the NTFS Read permission for FileA and the NTFS Full Control permission for FileB. As a result, the effective permission for the Users group for FileA is Read. This is because Read is the most restrictive permission. The effective permission for FileB is Full Control because both the shared folder permission and the NTFS permission allow this level of access.