BEST PRACTICES ACCORDING TO MICROSOFT
• Use NTFS permissions when possible and use share permissions
on FAT or FAT32 volumes only.
• Avoid using both share and NTFS permissions. The results can be
confusing, unpredictable, and difficult to troubleshoot.
• Assign permissions to groups, not individual users.
• Assign the most restrictive permissions possible.
• Avoid specifically denying permissions to a shared resource.
Only do so if you need to override specific permissions already
assigned.
• Limit membership to the Administrators group, as this group
has full control permissions by default.
• Avoid changing the default permissions for the Everyone group
when possible. The Everyone group includes numerous other
groups and your results could be unpredictable.
• Never deny access to the Everyone group because that group
includes Administrators. Instead, remove the Everyone group
rather than specifically denying the Everyone group.
Main Topics
Browse All Topics





by: oBdAPosted on 2009-11-02 at 09:42:30ID: 25721573
Use the Security tab to control permissions, and set the permissions in the Share tab to "Full Control" for Everyone.
You'll notice immediately that the permissions in the Security tab are way more fine-grained than the one in the Share permissions.
Share permissions are a relic of operating and file systems without security, to achieve at least a bit of security for remote access.
Do yourself a favor and don't mix them (the more restrictive one will win). Use NTFS only; unlike Share permissions, these will apply if the user is logging on locally as well.