Member Avatar for poloblue

Good Afternoon,

The question that I have is regarding file system (NTFS)

If you allow user1 access to a folder using windows shared folders, and remove all local (NTFS) permissions for all users, what happens?

Thank you

  • 3 Contributors
  • 2 Replies
  • 82 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by rch1231

Dani AI

Generated

Building on 's question and the replies from and : share permissions and NTFS permissions are evaluated together when somebody accesses a folder over the network. Granting User1 a share right alone does not bypass NTFS — the file system ACL is always checked and the most restrictive effective access applies. See Microsoft's notes on share vs NTFS behavior for details ().

If you remove or clear NTFS ACL entries so that the user has no explicit allow, that user will be blocked even if the share grants access. A local administrator can usually recover by taking ownership and resetting ACLs. Example (run elevated):

takeown /F "C:\Path\To\Folder" /R /A
icacls "C:\Path\To\Folder" /grant Administrators:F /T

Those are the common command-line steps; more options and caveats are documented in the Microsoft pages for takeown and icacls (takeown, icacls).

Practical advice: manage access with NTFS (not share ACLs) using groups rather than individual accounts, keep at least one administrative recovery account, back up ACLs before bulk changes (icacls can save/restore), and test Effective Access from the folder Advanced Security dialog before rolling changes into production.

Recommended Answers

All 2 Replies

Member Avatar for cwarn23

It depends how you define "remove all local NTFS permissions". If you mean to set the permissions to their default then some users may not be able to access files there were able to view before along with other files which shouldn't be viewable being viewable. That is only if you are meaning to set the permissions to their default.
If however you mean to strip all permissions from all users then nobody will be able to view anything.

Member Avatar for rch1231

Hello,

No matter what you can always take ownership of a file as an administrator or member of the administrators group. Doing drive recoveries I work with files that were created on another computer and with users I do not have. As the administrator of my computer I can go in and take ownership of the files and folders the do what ever is needed.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.