Share vs NTFS Permissions: How They Combine

When a user accesses a folder over the network, two separate permission sets are evaluated: the share permissions on the network share and the NTFS permissions on the underlying folder and its files. The effective permission is the more restrictive of the two. This means a user can have Full Control at the share level and still be unable to write if the NTFS permissions deny or omit write access. This page explains how the evaluation works, how to diagnose which permission is blocking access, and how to fix it without resorting to taking ownership of system folders—a practice that causes more problems than it solves.

How Permissions Are Evaluated

The evaluation happens in two stages:

1. Share permissions are checked against the user’s access token. These permissions apply only when the share is accessed over the network. They do not apply to local logon.
2. NTFS permissions are checked on the file system. These apply both locally and over the network.

For a network access, the effective permission is the intersection of the two. For example, if the share allows Change (which includes write) but the NTFS permissions allow only Read, the user gets Read. Conversely, if the share allows Read but the NTFS permissions allow Full Control, the user still gets Read. The most restrictive set always wins.

This dual-layer design is intentional: share permissions provide a coarse boundary at the network entry point, while NTFS permissions provide fine-grained control on the file system itself.

Diagnosing the Block

When a user reports an access denied error on a network share, the first step is to determine which permission set is causing the problem. Use the Effective Access tool in Windows to see the actual permissions for a specific user.

Using Effective Access

1. Open File Explorer and navigate to the folder that is shared.
2. Right-click the folder, select Properties, then go to the Security tab.
3. Click Advanced, then go to the Effective Access tab.
4. Click Select a user, enter the user account, and click OK.
5. The tool displays the effective permissions for that user on that folder.

If the effective permissions show Read but the user needs to write, the NTFS permissions are the limiting factor. If the effective permissions show Full Control but the user still cannot write, the share permissions are the problem.

Checking Share Permissions

To view the share permissions:

1. Right-click the folder, select Properties, then go to the Sharing tab.
2. Click Advanced Sharing, then Permissions.

This shows the share-level permissions for the share.

Fixing the Permissions

The fix depends on which permission set is too restrictive. Always change the permissions that are too restrictive, not the other way around. For example, if the NTFS permissions deny write, do not loosen the share permissions—that will not help. Instead, adjust the NTFS permissions.

Adjusting NTFS Permissions

To grant write access at the NTFS level:

1. Right-click the folder, select Properties, then go to the Security tab.
2. Click Edit, then Add.
3. Enter the user or group name, click OK.
4. In the permissions list, check the Write box (or Modify for more comprehensive access).
5. Click Apply and OK.

If the user needs to create files, Write is sufficient. If they need to delete or rename, Modify is required.

Adjusting Share Permissions

To grant write access at the share level:

1. Right-click the folder, select Properties, then go to the Sharing tab.
2. Click Advanced Sharing, then Permissions.
3. Select the user or group, and check the Change box (which includes write).
4. Click Apply and OK.

Common Misdiagnosis: Taking Ownership

A widespread piece of advice for fixing permission errors is to take ownership of the folder and replace all permissions. This is a natural mistake because it seems like a direct solution: if you own the object, you can do anything. However, taking ownership of system folders or folders with complex permission inheritance can break the security model of the operating system, leaving the system in an inconsistent state. For example, taking ownership of the C:\Windows folder can cause system instability, and it does not address the underlying permission configuration. The correct approach is to identify the specific permission that is too restrictive and adjust it, not to seize ownership.

Comparison Table

What People Get Wrong

A common misunderstanding is that share permissions are the primary control for network access. In reality, NTFS permissions are the more granular and often the actual bottleneck. Another mistake is assuming that granting Full Control at the share level is enough. Because the most restrictive permission wins, a user with Full Control at the share can still be blocked by NTFS permissions. This is a natural assumption because the share permissions are the first thing you see when setting up a share, but the NTFS permissions are the underlying layer that ultimately determines access.

Step-by-Step Repair

Step 1: Identify the User’s Effective Permissions

Use the Effective Access tool as described above. This tells you the actual permissions the user has on the folder.

Step 2: Determine Which Permission Set Is Limiting

Compare the effective permissions with the share permissions. If the effective permissions are more restrictive than the share permissions, the NTFS permissions are the limiting factor.

Step 3: Adjust the Restrictive Permission

• If NTFS is the problem, edit the NTFS permissions and add the necessary access.
• If share is the problem, edit the share permissions and add the necessary access.

Step 4: Test the Access

Have the user try to access the share again. If the problem persists, re-check the effective permissions, as changes may take a moment to propagate.

Command-Line Alternatives

For administrators who prefer the command line, the icacls tool can be used to view and modify NTFS permissions.

To view the current NTFS permissions on a folder:

icacls C:\SharedFolder

This outputs the access control list for the folder. The output shows entries like BUILTIN\Users:(OI)(CI)(RX) which means the Users group has read and execute permissions.

To grant write access to a user:

icacls C:\SharedFolder /grant "DOMAIN\username":(OI)(CI)M

This grants Modify permissions, which includes write, to the specified user. The (OI) and (CI) flags apply the permission to files and subfolders.

To view share permissions from the command line, use the net share command:

net share SharedFolder

This shows the share name, path, and the permissions. However, net share does not show detailed permissions; it shows the share-level access. To see the share permissions in detail, use the Advanced Sharing dialog in the GUI.

When to Reinstall

Reinstalling the operating system is rarely a solution for permission problems. It is a last resort that destroys all data and applications. Only consider a reinstall if the system is otherwise unusable and all other repair options have been exhausted. For permission issues, the fixes described here are sufficient in the vast majority of cases.

Summary of Commands