The Windows PC method fails in predictable ways — wrong permissions, broken mappings, a server IP that changed overnight. This summary is the setup in the one order that avoids all of them.
This is the whole Windows method condensed into a checklist you can follow in one sitting. The deep permission theory lives in the advanced sharing guides — here the goal is a working, tidy server: right name, right folders, right people, and drive letters that never break. Work top to bottom; every step makes the next one easier.
Everything depends on this. Rename the PC to something short and permanent — FILESERVER — and give it a fixed address: either a static IP set in Windows, or a DHCP reservation in your router using the network card's MAC address (find it with ipconfig /all). From today, every mapped drive and shortcut points at the name, never the raw IP. Names survive address changes; raw IPs break every mapping in the office the day anything changes.
Keep all shared data in one root — for example D:\Data — with one folder per department inside it: Accounts, Sales, Common, Management. Never share the entire drive, and never scatter shared folders across the desktop and Documents where backup and permissions become a guessing game. One root folder also means one backup job and one place to check when something goes missing.
Create a local user account on the server for every staff member, with a real password — password protected sharing stays ON, always. Then create one group per department per right: Accounts-Full and Accounts-Read, and put people in them. Permissions are granted to groups only. When a person joins, you create one account and add them to the right groups; when they leave, you disable one account and every door closes at once.
Share each department folder (Advanced Sharing, or the PowerShell route in the panel above) and set the share permission for its group. Then open the folder's Security tab and set the NTFS permissions to match — Modify for the Full group, Read for the Read group — and remove Everyone and guest-style entries. Windows applies the stricter of the two locks for network visitors, so when both say the same thing, nobody has to debug which lock refused them.
On the server: set the network profile to Private, turn on network discovery and file and printer sharing, and keep password protected sharing ON. Two warnings that save real pain. First, do not enable SMB1 to make an old device connect — SMB1 is the protocol ransomware made famous; replace or work around the old device instead. Second, on Windows 11 version 24H2 and later, guest (passwordless) access to shares is blocked by default — that is correct behaviour, not a bug; give the visitor a proper account.
On each staff PC, map the shares with the same drive letters for everyone — S: for the shared office drive, for example — always by name: net use S: \\FILESERVER\Common /persistent:yes. Matching passwords between the person's PC login and their server account make this silent; in a domain, Group Policy Preferences can push the maps automatically; in a workgroup, a one-line logon script does the same job. Finish by testing as a normal user: open, save, and try to open a folder they should NOT see. Access Denied on the forbidden folder is the sound of a setup done right.
Desktop Windows allows 20 simultaneous connections to shared resources. A ten-person office where everyone also connects a phone can approach it faster than you expect, and the symptom is random "no more connections" errors at the busiest hour. When you outgrow it, the honest upgrades are Windows Server or moving the same folder plan to TrueNAS — not registry tricks that promise to remove a licensing limit.
Watch the video to see the Windows method built live — shares, permissions and client mapping on a real PC, start to finish.
▶️ Watch Full VideoIt can share folders, but Home lacks the full local users and groups tools and the finer controls this setup uses. For an office server, Windows Pro is the right base — the upgrade cost is small next to the hours saved managing accounts.
Because the username or password on the client PC does not match an account on the server. Either match the passwords, or save the server credentials in Windows Credential Manager on the client. Turning off password protected sharing also stops the prompt — and removes your only real lock, so do not.
Technically yes, practically no. Whoever uses it will reboot it, fill its disk and install things — and the whole office loses its files each time. A file server earns a quiet corner, a cable connection and a rule that nobody works on it directly.