Networking Fundamentals

Combining share and NTFS permissions

We have already identified that NTFS permissions are effective both locally and over the network. Therefore, what if a user tries accessing a resource where the two sets of permissions conflict with each other? We perform a three-step process to identify the effective permission:

1. Look at the share permissions and take the least restrictive.
2. Look at the NTFS permissions and take the least restrictive.
3. Compare the two least restrictive permissions you identified at step 1 and step 2, and the most restrictive of these applies.

I'm going to give an example here to reinforce this. A user is in the groups listed:

Group	Share permission	NTFS permission
Sales	Full Control	Read
Managers