How do I need to secure my Windows Shares?

Question

I am working on an Domain Controller / File Server on Windows Server 2012.

Lets say that I am from a school and that I have 3 OU's (or security groups)

• Students
• Staff
• IT

When I create a shared directory, where teachers can share some files with students. I always set the permissions to:

• Share Permissions:
  

  • Everyone - Full Control

• NTFS Permissions:

  • Student - Read & Execute / Read
  • Staff - Modify / Read & Execute / Read / Write
  • IT - Full Control

I always do this, because of the "windows least privilege management"

Questions:

• For example, when I use the shares on a computer without Windows, are they also secured by the NTFS permission?

• Why are there two locations to change permissions and which location do I need to change?

Answer 1

Q: non-Windows computer

A: When you are connecting to shares on a Windows server, you are still secured by the combined share and NTFS permissions. The reason for this is that even a non-Windows system must use a compatible client protocol to connect and use these shares, therefore it does not bypass share and NTFS security.

Q: Why share and NTFS permissions are both needed

A: NTFS permissions secure the file system, whether the user is local or remote. Share permissions specify what remote access is granted. File shares use both technologies because they share resources on the file system for a remote user. Your scenario is an overlap of both security mechanisms. There are cases where you don't use both, like accessing files locally or sharing things other than the file system, like printers. Though printers also have permissions similar to NTFS permissions.