Share vs NTFS Permissions in Windows 2000

In Microsoft Windows 2000, network resource security relies on a dual-layer permission architecture: Share permissions and NTFS permissions. While Share permissions control entry through the network gateway, NTFS permissions regulate access to the underlying files and folders on the storage volume itself. When a user accesses data across a network, Windows 2000 evaluates both security layers simultaneously and enforces the most restrictive permission as the effective access right.

Share Permissions

Share permissions apply exclusively to users accessing resources over a network via Server Message Block (SMB). They do not govern users who log on locally to the computer hosting the shared folder.

In Windows 2000, Share permissions are configured at the top folder level of a share and offer three basic permission levels:

  • Read: Allows users to view folder names, open files, read data, and execute programs.
  • Change: Includes all Read capabilities, plus the ability to create new files, modify existing file contents, and delete files or folders.
  • Full Control: Grants all Change privileges, along with the ability to modify Share permissions (though not NTFS permissions).

By default, newly created shares in Windows 2000 grant the "Full Control" permission to the "Everyone" group. Share permissions apply globally to all files and subfolders within that shared resource, lacking the ability to apply distinct rules to individual files.

NTFS Permissions

NTFS permissions provide granular security controls implemented directly by the Windows 2000 NTFS file system. Unlike Share permissions, NTFS permissions apply to both local users and network users. They can be applied to entire volumes, specific folders, or individual files.

Standard NTFS permissions include:

  • Read: Allows viewing files, folder contents, and file attributes.
  • Write: Enables writing to files, creating new files, and changing file attributes.
  • List Folder Contents: Allows viewing the contents of a directory without reading specific file data.
  • Read & Execute: Combines Read capabilities with the ability to run applications.
  • Modify: Permits reading, writing, executing, and deleting files and folders.
  • Full Control: Grants all permissions, including the ability to take ownership of files and modify NTFS Access Control Lists (ACLs).

NTFS supports permission inheritance, where child folders and files automatically inherit permissions from their parent container unless inheritance is explicitly disabled. It also supports explicit "Deny" permissions, which override any conflicting "Allow" permissions.

How Share and NTFS Permissions Interact

When a network client requests access to a file located within a shared NTFS folder, Windows 2000 evaluates permissions using the following rules:

  1. Accumulation of Permissions: Group memberships are calculated for both layers independently. If a user is granted "Read" individually and "Change" via a group membership, their permission level for that specific layer is "Change."
  2. The Most Restrictive Rule: Windows 2000 compares the resulting Share permission against the resulting NTFS permission. The more restrictive of the two becomes the user's effective permission.

Interaction Examples:

  • Scenario A: A user has Change Share permission and Read NTFS permission.
    Result: The user only receives Read access.
  • Scenario B: A user has Full Control Share permission and Modify NTFS permission.
    Result: The user receives Modify access.
  • Scenario C: A user has Read Share permission and Full Control NTFS permission.
    Result: The user is limited to Read access over the network. If the user logs in locally at the server console, they bypass the Share layer entirely and receive Full Control.

Standard Implementation Strategy

To simplify administration in Windows 2000, the standard practice is to leave Share permissions permissive—such as granting "Change" or "Full Control" to a broad group like "Authenticated Users"—and handle all fine-grained security rules exclusively through NTFS permissions. This strategy eliminates administrative conflicts between the two layers and ensures uniform security policies whether data is accessed across the local area network or directly at the machine console.