SMB looks simple until the second user appears. A share that works perfectly for the local administrator fails for a service account because of one inherited ACE, and the symptom is never “access denied” in a useful place \u2014 it is an application log line saying the file is in use, or a backup job that silently writes zero bytes. On a Windows VPS where the share is the actual storage layer for IIS content or a scheduled export, permissions are the difference between a working service and a 3 a.m. call.<\/p>\n\n\n\n
This covers how NTFS and share permissions combine, where inheritance breaks, how to audit effective access without guessing, and how to automate share provisioning with PowerShell so the same ACE set lands on every VPS you build. All examples assume a Windows Server 2019\/2022 VPS with a single data volume, which is how most hosting images are laid out \u2014 the storage and OS options are summarised at our Windows VPS comparison<\/a>.<\/p>\n\n\n\n Windows evaluates share permission and NTFS permission separately and applies the more restrictive of the two. A user with Full Control on the share and Modify on NTFS gets Modify. A user with Read on the share and Full Control on NTFS gets Read. The trap is that share permissions default to Everyone:Read on a new share, so teams spend an hour editing ACLs before realising the ceiling was never raised.<\/p>\n\n\n\n Set the share ceiling to An ACE marked “This folder only” stops propagating the moment someone copies a directory tree with Audit for it with a one-liner that lists directories where inheritance is disabled: Use three groups per share and nothing else: This model means a rebuild is three Most single-server plans are not domain-joined, so local groups are the only option and they do not survive an image rebuild. Export them to CSV as a build artefact: Access-based enumeration adds a second trap. With ABE enabled, folders a user cannot read simply do not appear in the share, so a user reports a missing folder when in reality they lack List on a parent. Set it per share with The following has to be idempotent \u2014 it must be safe to run twice on the same host. For scheduled jobs, verify with the actual task principal rather than your own account \u2014 a task running as SYSTEM bypasses most denies and will pass a test that your application fails. Log the verification result in the build script so a rebuild that breaks permissions fails loudly instead of at the first customer upload. Provider-side disk layout and snapshot behaviour also affect whether ACLs survive a restore, which is worth confirming on the plan comparison table<\/a> before you commit a data volume to a single host.<\/p>\n\n","protected":false},"excerpt":{"rendered":"Share permissions are a ceiling, not a grant<\/h2>\n\n\n\n
Everyone:Change<\/code> and do all real authorisation in NTFS, where you have inheritance, auditing, and icacls<\/code> support. Never create per-user share permissions \u2014 they do not survive a share recreation and are invisible in Explorer’s Security tab. Check the ceiling with Get-SmbShareAccess -Name data<\/code> and confirm it looks identical on every host you build.<\/p>\n\n\n\nWhere inheritance silently breaks<\/h2>\n\n\n\n
robocopy<\/code> without \/SEC<\/code>, or restores files from a backup catalog. The child objects keep explicit ACEs copied from the source and no longer inherit. Result: new files land in a folder whose inherited policy no longer reaches subfolders, and permissions drift only on that branch.<\/p>\n\n\nGet-ChildItem D:\\data -Directory -Recurse | Where-Object { (Get-Acl $_.FullName).AreAccessRulesProtected } | Select-Object FullName<\/code>. Re-enable inheritance deliberately, not in bulk, because enabling it on a folder that relied on explicit denies will broaden access.<\/p>\n\n\n\nA permission model that survives rebuilds<\/h2>\n\n\n\n
SG_Data_Read<\/code>, SG_Data_Modify<\/code>, and SG_Data_Admin<\/code>. Assign users to groups, never to folders. Grant the groups at the share root with inheritance enabled, and add a single explicit deny only where a genuine exception exists \u2014 a quarantine folder that no one but the admin group can read.<\/p>\n\n\nicacls<\/code> calls and two Add-LocalGroupMember<\/code> calls. It also means access reviews are group membership exports, which any auditor will accept, rather than an ACL diff that no one can read. Keep the group names stable across hosts so a script written once applies everywhere.<\/p>\n\n\n\nRecommended ACL matrix<\/h2>\n\n\n\n
Path<\/th> Principal<\/th> NTFS rights<\/th> Applies to<\/th><\/tr><\/thead> D:\\data<\/td> SG_Data_Read<\/td> Read & Execute<\/td> This folder, subfolders, files<\/td><\/tr> D:\\data<\/td> SG_Data_Modify<\/td> Modify<\/td> This folder, subfolders, files<\/td><\/tr> D:\\data<\/td> SG_Data_Admin<\/td> Full Control<\/td> This folder, subfolders, files<\/td><\/tr> D:\\data\\quarantine<\/td> SG_Data_Read<\/td> Deny: List folder<\/td> This folder only<\/td><\/tr> D:\\data\\quarantine<\/td> SG_Data_Admin<\/td> Full Control<\/td> This folder, subfolders, files<\/td><\/tr> D:\\data\\drop<\/td> SG_Data_Modify<\/td> Write, Create files<\/td> This folder only<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Where the model breaks on a workgroup VPS<\/h2>\n\n\n\n
Get-LocalGroupMember SG_Data_Modify | Export-Csv members.csv<\/code>. Restoring a rebuilt host becomes one import loop, and the ACLs come back from the same script that created them.<\/p>\n\n\n\nSet-SmbShare -Name data -FolderEnumerationMode AccessBased<\/code> \u2014 off by default on Server 2019\/2022 \u2014 and leave it off for application shares, where a service expecting a predictable listing fails in a way that looks like a timeout.<\/p>\n\n\n\nAutomating share creation with PowerShell<\/h2>\n\n\n\n
New-SmbShare<\/code> fails if the share exists, so test first, and use icacls<\/code> with \/grant<\/code> rather than rebuilding the whole DACL, which would drop explicit denies you set on purpose.<\/p>\n\n\n\n$path = 'D:\\data'\n$name = 'data'\nif (-not (Get-SmbShare -Name $name -ErrorAction SilentlyContinue)) {\n New-SmbShare -Name $name -Path $path -ChangeAccess 'Everyone' -FullAccess 'Administrators'\n}\nforeach ($g in 'SG_Data_Read','SG_Data_Modify','SG_Data_Admin') {\n if (-not (Get-LocalGroup -Name $g -ErrorAction SilentlyContinue)) { New-LocalGroup -Name $g }\n}\nicacls $path \/grant 'SG_Data_Read:(OI)(CI)RX' 'SG_Data_Modify:(OI)(CI)M' 'SG_Data_Admin:(OI)(CI)F' \/T \/Q\nicacls $path \/inheritance:e<\/code><\/pre>\n\n\n\nVerifying effective access before users complain<\/h2>\n\n\n\n
icacls<\/code> shows ACEs but not the result. Use Get-Acl<\/code> plus a group expansion to compute effective access for a named user, or rely on the SMB client itself: net use Z: \\\\localhost\\data \/user:DOMAIN\\svc_web<\/code> from the server, then attempt a write. A successful write from a session running as the service account is the only proof that matters.<\/p>\n\n\n\n