Skip to content
Windows.HomesUnofficial

SMB share on Windows Server 2025: share and NTFS permissions without Everyone

Verified 1 min read

Create an SMB share with explicit share/NTFS permissions, access-based enumeration, signing checks and a restore test on a Windows Server 2025 lab.

Tested onStandard / Datacenter (Evaluation) · Build 26100.33650 · x64
E1
Build
26100.33650
Edition
Standard / Datacenter (Evaluation)
Architecture
x64
Support
Lab (E1)
Evidence
E1Official documentation
Verified
2026-10-28
Page type
Server role

The short answer

Section titled “The short answer”

A share has two permission layers:

  1. Share permissions — who can connect over SMB.
  2. NTFS permissions — what they can do inside the folder.

The effective access is the most restrictive combination. Grant Everyone: Full Control at the share and fix it with NTFS is a common lab shortcut that becomes a production incident.

Use groups, explicit shares, and test with a real user account.

Build the folder and groups

Section titled “Build the folder and groups”
Terminal window
New-Item -ItemType Directory -Path D:\Shares\Finance
New-ADGroup -Name 'GG-Finance-RW' -GroupScope Global -Path 'OU=Groups,DC=lab,DC=internal'
New-ADGroup -Name 'GG-Finance-RO' -GroupScope Global -Path 'OU=Groups,DC=lab,DC=internal'

Put users in the groups. Do not assign permissions to individual users if a group will do.

NTFS first

Section titled “NTFS first”
Terminal window
icacls D:\Shares\Finance /inheritance:r
icacls D:\Shares\Finance /grant 'LAB\Domain Admins:(OI)(CI)F'
icacls D:\Shares\Finance /grant 'LAB\GG-Finance-RW:(OI)(CI)M'
icacls D:\Shares\Finance /grant 'LAB\GG-Finance-RO:(OI)(CI)RX'

(OI)(CI) applies to files and folders; M is modify, RX read/execute. Remove Users/Everyone unless you have a documented reason.

Then the share

Section titled “Then the share”
Terminal window
New-SmbShare -Name 'Finance' -Path 'D:\Shares\Finance' -FullAccess 'LAB\Domain Admins' -ChangeAccess 'LAB\GG-Finance-RW' -ReadAccess 'LAB\GG-Finance-RO'
Set-SmbShare -Name 'Finance' -FolderEnumerationMode AccessBased
Get-SmbShareAccess -Name 'Finance'

Access-based enumeration hides folders the user cannot read. It is not a security boundary by itself; NTFS still does the enforcement.

Verify from a client

Section titled “Verify from a client”
Terminal window
net use Z: \\dc1\Finance /user:LAB\financeuser *
Get-SmbConnection
icacls Z:\

Test:

  • a read-only user cannot create/delete;
  • a modify user can create/rename;
  • an unrelated user cannot list the share;
  • the share survives a reboot.

Signing, encryption and firewall

Section titled “Signing, encryption and firewall”
Terminal window
Get-SmbServerConfiguration |
  Select-Object EnableSMB1Protocol, RequireSecuritySignature, EnableSecuritySignature, EncryptData
  • Keep SMB1 disabled.
  • Prefer signing/encryption where clients support it; test older devices before enforcing.
  • Allow File and Printer Sharing only on the required network profile; do not open SMB to the internet.

Break it deliberately

Section titled “Break it deliberately”
  1. Remove a user from the group; confirm access changes after re-logon.
  2. Rename the share; confirm clients fail and the old path is gone.
  3. Restore a file from backup; confirm permissions are preserved.
  4. Snapshot the VM before changing ACLs; document the rollback.

Sources