Many experienced admins get this wrong. Here's how to do it right.
There are a 5 parts to this.
CREATE THE GROUP
- -login to server.
- -click ACTIVE-DIRECTORY-USERS-AND-COMPUTERS.
- -create an GROUP (aka SECURITY-GROUP).
- -add the users/members.
CREATE THE SHARE
- -create a folder.
- -right-click to PROPERTIES > SHARING.
- -click ADVANCED-SHARING.
- -checkmark SHARE-THIS-FOLDER.
- -if hidden, add a $ at the end.
ADD SHARE PERMISSIONS
- -click PERMISSIONS.
- -remove all groups/users.
- -add the GROUP required for this share.
- -checkmark FULL-CONTROL.
- -click OK > OK.
ADD NTFS PERMISSIONS
- -click SECURITY tab (at the top).
- -click ADVANCED (at the bottom).
- -click DISABLE ENHERITANCE.
- -click CONVERT INHERITED PERMISSIONS INTO EXPLICIT PERMISSIONS.
- -remove all groups/users except SYSTEM.
- -add the GROUP required for this share.
- -checkmark FULL-CONTROL.
- -click OK > APPLY.
TEST PERMISSIONS
- -click the EFFECTIVE ACCESS tab (at the top).
- -test the user/group you want to make sure can access.
BONUS: ONLY SHOW FOLDERS THE USER HAS ACCESS TO
If a user doesn't have access to "Accounting" folder, then that folder does not show.
This is called "Access Based Enumeration."
- -launch SERVER MANAGER (on the server).
- -click on FILE AND STORAGE SERVICES.
- -click on SHARES (on the left-hand side).
- -on EACH SHARE (one at a time), right click on the share and select PROPERTIES
- -expand SETTINGS.
- -click ENABLE ACCESS BASED ENUMERATION.
NOTES:
- -the EVERYONE group does not include everyone. This is why it should not be used.
- -the most restrictive permissions win.
- -the group is assigned to the user upon login. Consequently, the user will have to logout and login again to test if the share is working.