# SMB share on Windows Server 2025: share and NTFS permissions without Everyone

> Create an SMB share with explicit share/NTFS permissions, access-based enumeration, signing checks and a restore test on a Windows Server 2025 lab.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter (Evaluation)
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-28

## The short answer

A share has **two** permission layers:

1. **Share permissions** — who can connect over SMB.
2. **NTFS permissions** — what they can do inside the folder.

The effective access is the **most restrictive** combination. Grant `Everyone: Full Control` at the share and fix it with NTFS is a common lab shortcut that becomes a production incident.

Use groups, explicit shares, and test with a real user account.

## Build the folder and groups

```powershell
New-Item -ItemType Directory -Path D:\Shares\Finance
New-ADGroup -Name 'GG-Finance-RW' -GroupScope Global -Path 'OU=Groups,DC=lab,DC=internal'
New-ADGroup -Name 'GG-Finance-RO' -GroupScope Global -Path 'OU=Groups,DC=lab,DC=internal'
```

Put users in the groups. Do not assign permissions to individual users if a group will do.

## NTFS first

```powershell
icacls D:\Shares\Finance /inheritance:r
icacls D:\Shares\Finance /grant 'LAB\Domain Admins:(OI)(CI)F'
icacls D:\Shares\Finance /grant 'LAB\GG-Finance-RW:(OI)(CI)M'
icacls D:\Shares\Finance /grant 'LAB\GG-Finance-RO:(OI)(CI)RX'
```

`(OI)(CI)` applies to files and folders; `M` is modify, `RX` read/execute. Remove `Users`/`Everyone` unless you have a documented reason.

## Then the share

```powershell
New-SmbShare -Name 'Finance' -Path 'D:\Shares\Finance' -FullAccess 'LAB\Domain Admins' -ChangeAccess 'LAB\GG-Finance-RW' -ReadAccess 'LAB\GG-Finance-RO'
Set-SmbShare -Name 'Finance' -FolderEnumerationMode AccessBased
Get-SmbShareAccess -Name 'Finance'
```

Access-based enumeration hides folders the user cannot read. It is not a security boundary by itself; NTFS still does the enforcement.

## Verify from a client

```powershell
net use Z: \\dc1\Finance /user:LAB\financeuser *
Get-SmbConnection
icacls Z:\
```

Test:

- a read-only user cannot create/delete;
- a modify user can create/rename;
- an unrelated user cannot list the share;
- the share survives a reboot.

## Signing, encryption and firewall

```powershell
Get-SmbServerConfiguration |
  Select-Object EnableSMB1Protocol, RequireSecuritySignature, EnableSecuritySignature, EncryptData
```

- Keep SMB1 disabled.
- Prefer signing/encryption where clients support it; test older devices before enforcing.
- Allow **File and Printer Sharing** only on the required network profile; do not open SMB to the internet.

> **Caution: A share is not a backup**
>
> A mapped drive on the same server is not a backup. Keep an independent copy and test a restore. SMB permissions do not protect against ransomware running as an authorised user.

## Break it deliberately

1. Remove a user from the group; confirm access changes after re-logon.
2. Rename the share; confirm clients fail and the old path is gone.
3. Restore a file from backup; confirm permissions are preserved.
4. Snapshot the VM before changing ACLs; document the rollback.

## Sources

- [Microsoft Learn — SMB share creation](https://learn.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview)
- [Microsoft Learn — New-SmbShare](https://learn.microsoft.com/en-us/powershell/module/smbshare/new-smbshare)
- [Microsoft Learn — SMB security](https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-security)

---

Source: https://windows.homes/en/server/roles/smb/