File Server with NTFS + Share Permissions

A Windows Server 2022 file server with department shares, hidden share names, and layered NTFS + Share permissions. Built and tested in a Hyper-V lab.

This is a hands-on demonstration of the single most common topic helpdesk and IT support interviewers test: how share permissions and NTFS permissions interact, and which one wins.

---

Lab Environment

Component	Details
Hypervisor	Hyper-V on Windows 11
Domain Controller	MUS-DC-01 — Windows Server 2022, AD DS + DNS, domain Musah.com
Client 1	MUS-WIN-01 — Windows 11, domain-joined
Client 2	MUS-WIN-02 — Windows 11, domain-joined
File server data drive	E:\ (second virtual disk attached to the DC for this lab)

---

Skills Demonstrated

• Installing the File Server role on Windows Server 2022
• Designing a department-based share structure
• NTFS permissions (per-folder, per-security-group, with inheritance disabled)
• SMB share permissions (hidden shares with $, Authenticated Users + Change)
• Layering Share + NTFS so the more restrictive permission wins
• Positive and negative access testing from domain-joined clients

---

Project Steps

1. Install the File Server role

Server Manager → Manage → Add Roles and Features → File and Storage Services → File and iSCSI Services → File Server.

2. Build the folder structure on E:\

Created E:\Shares and one subfolder per department: Finance, HR, IT, Marketing, Public, Sales.

3. Set NTFS permissions per department

For each department folder:

1. Properties → Security → Advanced → Disable inheritance → Convert inherited permissions.
2. Removed every entry except SYSTEM and Administrators.
3. Added the matching department security group (e.g. HR-Staff for HR) with Modify.
4. For Public, added Domain Users with Modify.

4. Create hidden SMB shares

Each department folder shared with a $ suffix so it does not appear in network browsing. Share permissions set to Authenticated Users — Change (the actual access control happens at the NTFS layer).

5. Create a test file locally

Logged in to the server, created MyTest.txt inside E:\Shares\Finance. The "State: Shared" indicator at the bottom of File Explorer confirms the folder is shared.

6. Verify access from a client (positive test)

From MUS-WIN-02, signed in as a Finance user, navigated to \\MUS-DC-01\Finance$. The test file is visible.

7. Open and read the file from the client

Opened MyTest.txt directly from the share to confirm read access works end-to-end.

8. Verify a non-member is denied (negative test)

While still signed in as the Finance user, attempted to access \\MUS-DC-01\hr$. Windows correctly returned Access Denied — the user is not a member of HR-Staff, and NTFS enforced it.

---

Verification Checklist

• Finance users can read and write inside Finance$
• HR users cannot reach Finance$ (Access Denied)
• Hidden shares do not appear when browsing \\MUS-DC-01
• Mapped drive letter behaves as expected for permitted users

---

Key Concept — NTFS vs Share

The more restrictive of the two wins over the network. NTFS applies locally and remotely. Share applies only over the network.

That is why this build keeps share permissions broad (Authenticated Users — Change) and does the real access control at the NTFS layer with security groups. One bad share permission cannot accidentally expose everything, and access changes are made by adding or removing a user from a security group — never by editing folder ACLs directly.

---

Interview Talking Point

I deployed a file server with hidden department shares. I set Share permissions to Authenticated Users — Change, then layered NTFS permissions by security group for actual access control. That way one bad share permission cannot accidentally expose everything, and I can change access by moving a user between groups instead of touching every folder.

---

Repo Layout

File-Server-NTFS-Share-Permissions/
├── README.md
├── .gitignore
└── screenshots/
    ├── 01-role-install.png
    ├── 02-folder-structure.png
    ├── 03-ntfs-permissions.png
    ├── 04-hidden-share.png
    ├── 05-local-file-shared.png
    ├── 06-client-positive-access.png
    ├── 07-file-read-from-client.png
    └── 08-access-denied.png