Windows Server File Sharing and Access Control

Overview

I configured a Windows Server file-sharing solution for a department, using Active Directory to organize users and control access to shared resources. The implementation included a dedicated shared folder, a custom SMB share name, concurrent-user limits, Active Directory organizational units and security groups, and separate share and NTFS permissions.

Objectives

• Provide a centralized shared folder for department users.

• Keep the Windows Server accessible through a consistent static IP address.

• Organize users and security groups in Active Directory.

• Control access to the shared folder through a security group.

• Separate share permissions from NTFS permissions for more granular access control.

• Limit concurrent connections to help control server and network resource usage.

Technologies Used

• Windows Server

• Active Directory Domain Services (AD DS)

• Active Directory Users and Computers

• SMB File Sharing

• NTFS Permissions

• Global Security Groups

• Organizational Units (OUs)

• fsmgmt.msc

Configurations

The Windows Server was already configured with a static IP address. This ensured that users could consistently connect to the server without having to change the server address after network changes.

I selected a drive other than the C: drive for the shared data. Keeping shared data separate from the operating system helps isolate user data from the system files and makes storage management and future maintenance easier. I then created a dedicated folder at a fixed location to be used as the shared folder.

From the folder properties, I opened the Sharing tab and selected Advanced Sharing.

I enabled Share This Folder and assigned a short, lowercase share name. This made the share easier to type and reduced the possibility of typing errors. I also configured a limit on the number of concurrent users who could access the share to help control resource and bandwidth usage, particularly when users were performing operations such as backups.

I then organized the users and groups in Active Directory. The existing users were not organized by department, so I created an OU named Sales and moved the Sales users from the default Users container into it.

I also created a separate Groups OU to keep the security groups used for resource access organized and separate from the user accounts.

The Sales users were then moved into the new Sales OU. The accounts shown in the configuration are example accounts such as user1, user2, and user3.

I created a Global Security Group inside the Groups OU. Using a security group for access control allowed me to manage permissions centrally instead of assigning permissions to individual users.

I then added the Sales users to this security group.

Because the shared folder was configured with a custom share name, the required sharing options were not always available directly from the folder properties. I therefore used fsmgmt.msc to locate and manage the shared folder. The sharing configuration could also be accessed through Properties > Security > Advanced > Share.

From the shared folder's Share Permissions, I removed the default Everyone group and added the newly created security group. This restricted network access to members of the designated Sales group.

I then verified that the new group was correctly assigned to the shared folder.

Finally, I configured more granular access using NTFS permissions. From the folder properties, I opened Security > Advanced > Permissions, selected the Sales security group, and assigned the required permissions for the department users.

Using both share and NTFS permissions provided two layers of access control. Share permissions controlled access through the network share, while NTFS permissions provided more detailed control over what authorized users could do with the files and folders.