4

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according to my desires. Trying to setup Share and NTFS permissions to match always seemed to cause problems and was a pain due to extra work.

My question is, could this setup result in any security issues such as someone accessing files they shouldn't? Is relying on the NTFS permissions sufficient to secure access to the files?

A couple examples of how things are setup:

  • \\media-pc\media
    This share contains movies, music, etc. Everyone should be able to read from here, but only I should be able to write/delete. The share is configured for full control to everyone. NTFS permissions grant read to the Users group, and Full Control to my user.

  • \\work-pc\projects and \\laptop\projects
    These shares let me transfer work projects between my desktop and laptop. Only I should be able to access anything in these folders. Share permissions are setup for Full Control to everyone. NTFS permissions grant full control to my account. Other accounts / the users group are not listed.

The network consists of a mix of windows 10 / windows 7 machines and my android phone/tablet. Password protected sharing is turned off on all the windows machines.

Improve this question

3 Answers 3

Reset to default
0

It should be fine to run the setup as you described.

However, in the time of network share infecting ransomware you should double think about any write permission you give - even to yourself. Consider defining old files you don't touch as read-only.

Improve this answer
3
  • In regard to the ransomware notion, you can counteract that by having really good, current backups. There are several products that have saved my butt over the years due to their amazing capabilities in regard to backups and malware.
    – Brad Bouchard
    Mar 15, 2016 at 16:42
  • Of course, backups are important and everyone should do it - not only because of ransomware. But relying on backups for defense against ransomware implies that you are able to detect the infection early enough. Furthermore, many ransomware is FUD for a long time since it signature changes on a regular basis.
    – Noir
    Mar 15, 2016 at 16:49
  • I didn't say to rely on backups for defense against ransomware; it's simply another layer of defense that can be used to recover from ransomware, but I didn't say or imply that it was to be relied upon as a sole means of defense.
    – Brad Bouchard
    Mar 15, 2016 at 17:12
0

Is ignoring them ok?

No.

Explanation

I'll try to make this simple. The most restrictive of the two will take precedence. So, if you have read-only NTFS permissions on a folder inside of a share where you have Full Access share permissions, you'll still only have read-only to that folder inside of the share as the more restrictive of the two (read-only NTFS) will win; vice versa as well. And it's the same for deny/allow permissions. Denys always take precedence so remember that.

What To Do

Basically, setting your share to Everyone with full access, and then restricting the actual access to the folders/data inside of the share by using more restrictive NTFS permissions is the way to go. That is, of course, unless you want to restrict shares even more and only have certain users see the shares, at which point Access-Based Enumeration comes in handy and you'll want to enable it.

What you've set on your example folders above will accomplish what you're looking to accomplish.

See this for more examples and a further in-depth explanation.

Improve this answer
0

When I am using a NTFS file system and right click a folder to select share with specific people, Windows will automatically grant Everyone Full Control for that folder. So I guess Microsoft is trying to deprecate the old Share permission settings with the new NTFS Security settings. The Security tag is not availabe on FAT-type file systems, where you have to rely on the old Share permission.

This article may give more info.

https://www.howtogeek.com/72718/how-to-understand-those-confusing-windows-7-fileshare-permissions/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .