I am working on an Domain Controller / File Server on Windows Server 2012.
Lets say that I am from a school and that I have 3 OU's (or security groups)
- Students
- Staff
- IT
When I create a shared directory, where teachers can share some files with students. I always set the permissions to:
Share Permissions:
- Everyone - Full Control
NTFS Permissions:
- Student - Read & Execute / Read
- Staff - Modify / Read & Execute / Read / Write
- IT - Full Control
I always do this, because of the "windows least privilege management"
Questions:
For example, when I use the shares on a computer without Windows, are they also secured by the NTFS permission?
Why are there two locations to change permissions and which location do I need to change?