13.1 Windows Server File Share Access, NTFS Permissions & Access-Based Enumeration
Key Takeaways
- Windows Server offers SMB Share - Quick for general sharing, SMB Share - Advanced when FSRM quotas and classification are needed, and SMB Share - Applications for Hyper-V and database workloads.
- Share permissions and NTFS permissions are evaluated independently over the network and the effective right is the more restrictive of the two.
- The common practice is to grant Authenticated Users Full Control at the share and do all real access control in NTFS, so there is a single place to audit.
- An explicit Deny always overrides an allow inherited or granted through any group membership.
- Access-Based Enumeration hides items a user cannot at least read from directory listings, which stops folder names themselves from leaking organizational information.
Windows Server File Share Access, NTFS Permissions & Access-Based Enumeration
File services form the core storage foundation of enterprise infrastructure. Windows Server provides enterprise-grade data management through the File and Storage Services role, combining modern Server Message Block (SMB) and Network File System (NFS) protocols with granular NTFS Access Control Lists (ACLs) and Access-Based Enumeration (ABE).
This section covers share creation, the share-versus-NTFS permission calculation model, and Access-Based Enumeration. Governance through File Server Resource Manager (FSRM) — quotas, active file screening, storage reports, and file management tasks — is covered in section 13.2.
1. Windows Server File Share Profiles: SMB vs. NFS
When provisioning file shares in Windows Server via Server Manager or Windows PowerShell, administrators select from predefined share profiles tailored to specific workload characteristics, protocols, and performance requirements.
+-----------------------------------------------------------------------------------+
| WINDOWS SERVER FILE SHARE PROFILES |
| |
| +--------------------------+ +--------------------------+ +-----------------+ |
| | SMB Share - Quick | | SMB Share - Advanced | | SMB Share - Apps| |
| |--------------------------| |--------------------------| |-----------------| |
| | - Basic file sharing | | - FSRM Quota enforcement | | - Hyper-V VMs | |
| | - Standard permissions | | - Data Classification | | - SQL Server DB | |
| | - Fast deployment | | - Access-Based Enum. | | - Cont. Avail. | |
| +--------------------------+ +--------------------------+ +-----------------+ |
| |
| +-----------------------------------------------------------------------------+ |
| | NFS Shares (NFSv3 & NFSv4.1) | |
| |-----------------------------------------------------------------------------| |
| | - Cross-platform sharing for Linux / UNIX clients | |
| | - UID / GID identity mapping (Active Directory or local passwd/group files) | |
| | - Kerberos v5 privacy/integrity and AUTH_SYS authentication | |
| +-----------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------+
SMB Share Profiles
| Share Profile | Target Workload | Key Capabilities & Characteristics |
|---|---|---|
| SMB Share - Quick | General office documents, departmental shares | Provisions basic SMB sharing with default NTFS inheritance. Suitable for fast, general-purpose file distribution without advanced compliance controls. |
| SMB Share - Advanced | Regulated enterprise file repositories | Integrates directly with File Server Resource Manager (FSRM). Allows instant configuration of folder quotas, active file screening, and Data Classification Infrastructure (DCI) properties during share creation. |
| SMB Share - Applications | Hyper-V virtual disk storage (.vhdx), SQL Server database files | Enables Continuous Availability (CA), disables caching, configures maximum SMB 3.x buffer allocations, and sets strict NTFS permissions required for service accounts and cluster nodes. |
NFS Share Profiles for Linux / UNIX Interoperability
Windows Server includes the Server for NFS role service, enabling heterogeneous Linux, UNIX, and macOS clients to mount Windows volumes over NFSv3 and NFSv4.1.
- Authentication Models:
- AUTH_SYS (UNIX style): Relies on numeric User ID (UID) and Group ID (GID) passed in the RPC header. Requires mapping UIDs/GIDs to Active Directory user accounts via Active Directory Domain Services (AD DS) RFC 2307 schema extensions or local mapping files.
- Kerberos (v5, v5i, v5p): Provides enterprise authentication (
krb5), data integrity signing (krb5i), and full packet privacy/encryption (krb5p) utilizing Active Directory Kerberos realms.
- Root Squash Configuration: Controls whether the UNIX root user (
UID 0) retains root privileges or is squashed to an anonymous user (UID -2/65534) to prevent privilege escalation on the file server.
Creating File Shares via PowerShell
# Install File and Storage Services role with FSRM and NFS support
Install-WindowsFeature -Name FS-FileServer, FS-Resource-Manager, FS-NFS-Service -IncludeManagementTools
# Create an advanced SMB share with Access-Based Enumeration and Encryption enabled
New-SmbShare `
-Name 'FinanceDocs' `
-Path 'D:\Shares\Finance' `
-FullAccess 'CORP\Domain Admins' `
-ChangeAccess 'CORP\Finance-Team' `
-ReadAccess 'CORP\Auditors' `
-FolderEnumerationMode AccessBased `
-EncryptData $true
# Create an NFS share with Kerberos authentication and Root Squash enabled
New-NfsShare `
-Name 'LinuxData' `
-Path 'D:\Shares\NFSData' `
-Authentication 'Krb5', 'Krb5i', 'Krb5p' `
-AllowRootAccess $false
2. NTFS Permissions vs. Share Permissions: The Evaluation Pipeline
Securing network-accessible file systems requires managing two distinct authorization layers: Share Permissions (governing network entry) and NTFS Permissions (governing local and file system object access).
+-----------------------------------------------------------------------------------+
| PERMISSION EVALUATION PIPELINE |
| |
| [Remote User Request] ---> \\Server\Share\Folder\Report.docx |
| | |
| v |
| [Layer 1: Share Permissions] ---> Evaluates Share ACL (e.g., Change) |
| | |
| v |
| [Layer 2: NTFS Permissions] ---> Evaluates File/Folder DACL (e.g., Read) |
| | |
| v |
| [Effective Access Output] ---> MOST RESTRICTIVE WINS (Result: Read Only) |
+-----------------------------------------------------------------------------------+
Permission Layer Comparison
| Dimension | Share Permissions | NTFS Permissions |
|---|---|---|
| Application Scope | Network access across SMB shares only | Both network access AND local console/RDP access |
| Granularity | Coarse: Full Control, Change, Read | Highly granular: 14 basic & advanced permissions (Read, Write, Modify, Full Control, Take Ownership, etc.) |
| File-Level Control | Applies uniformly to all objects in the share | Applies individually to folders, subfolders, and discrete files |
| Inheritance | None (Flat structure) | Full hierarchical inheritance with explicit blocking capability |
| File System Support | Any shared file system (NTFS, ReFS, FAT32) | NTFS and ReFS volumes only |
The Golden Rule: Most Restrictive Wins
When a user connects to a folder over an SMB network share, Windows Server computes the cumulative Share Permission token and cumulative NTFS Permission token for the user and all groups to which the user belongs. The resulting Effective Permission is the intersection of both layers—meaning the most restrictive permission is enforced.
+-----------------------------------------------------------------------------+
| PERMISSION INTERSECTION EXAMPLES |
| |
| Share Permission NTFS Permission Effective Network Access |
| ------------------ ------------------ ------------------------ |
| Read Full Control -> Read Only |
| Change Read -> Read Only |
| Full Control Modify -> Modify (Read/Write/Delete) |
| Full Control Full Control -> Full Control |
| Change Deny Write -> Read Only (Explicit Deny) |
+-----------------------------------------------------------------------------+
[!IMPORTANT] Explicit Deny Precedence: Within NTFS permissions, an Explicit Deny always overrides an Explicit Allow or Inherited Allow. If a user is granted Full Control via group
Finance-Adminsbut is assigned Deny Write via groupTemporary-Staff, the write operation is blocked.
Best Practice Recommendation
Set Share Permissions to Authenticated Users: Full Control (or Change) and use NTFS Permissions exclusively to govern access boundaries. This centralizes access control management directly on the file system, avoiding conflicting dual-layer security bugs.
3. Access-Based Enumeration (ABE)
By default, when users browse an SMB file share, Windows displays all child folders and files contained within that directory—even if the user lacks permissions to open or read those items. This default behavior presents security and privacy risks in multi-tenant or departmental file shares.
ABE Mechanics
Access-Based Enumeration (ABE) filters the directory enumeration response returned by the server. When ABE is enabled:
- The SMB server checks the caller's security token against the discretionary access control list (DACL) of each folder and file in the directory.
- If the user does not possess at least Read (or equivalent read attributes/list directory) permissions, the server strips that object from the directory listing returned to the client.
- The user only sees folders and files they have explicit or inherited rights to access.
+-----------------------------------------------------------------------------------+
| ACCESS-BASED ENUMERATION (ABE) |
| |
| [File Server Volume: D:\Departments] |
| |-- Legal (ACL: Legal-Team Read/Write) |
| |-- HR (ACL: HR-Team Read/Write) |
| |-- Engineering (ACL: Eng-Team Read/Write) |
| |
| [Client View: Alice (Member of Legal-Team only)] |
| \\Server\Departments\ |
| `-- Legal <-- HR and Engineering are completely hidden! |
+-----------------------------------------------------------------------------------+
Enabling ABE via GUI and PowerShell
In Server Manager, open File and Storage Services -> Shares, right-click the target share, select Properties -> Settings, and check Enable access-based enumeration.
# Enable ABE on an existing SMB share
Set-SmbShare -Name 'Departments' -FolderEnumerationMode AccessBased
# Query ABE status across all local SMB shares
Get-SmbShare | Select-Object Name, Path, FolderEnumerationMode
A system administrator shares a folder named 'Confidential' with Share Permissions set to 'Authenticated Users: Read'. The underlying NTFS permissions on 'D:\Shares\Confidential' are set to 'CORP\Finance-Team: Modify'. A member of the Finance-Team connects over the network to '\Server\Confidential' and attempts to modify an existing spreadsheet. What is the result?
A company hosts a multi-department file share where all department folders reside in a single shared directory. Non-HR employees complain that they can see the 'HumanResources' folder in File Explorer, even though clicking it results in an access-denied error. What should the administrator configure to hide inaccessible folders entirely?