One shared folder, many people — but not everyone should get the same rights. This guide sets up sharing the professional way: share permissions, NTFS permissions, groups and auditing, in the right order.
Most people share a folder in ten seconds: right-click, Share, Everyone, done. It works — and it also gives every person on the network full power to delete everything. An IT admin shares differently. There are two separate locks on a shared folder, access is given to groups instead of people, and auditing quietly records who touched what. Set it up once, the way this page shows, and adding or removing a staff member later takes thirty seconds.
Every network visit to a folder passes two checks. First the share permission — the list set on the Sharing tab, which only applies to people coming over the network. Then the NTFS permission — the list on the Security tab, which applies to everyone, network or sitting at the PC.
Windows combines both and applies the more restrictive result. Share says Full Control but NTFS says Read? The visitor gets Read. This one rule explains almost every "but I gave full access" problem.
fsmgmt.msc and press Enter — this is Shared Folders, the admin console for sharesThe simple right-click sharing wizard works too, but it hides half of these choices. The console shows every share on the PC in one list — including old ones you forgot about.
New files inside the folder inherit these rights automatically, so you set this once per folder, not once per file.
This is the habit that separates an admin setup from a messy one. When permissions point at individual people, every staff change means hunting through ten folders. When they point at a group, you change membership in one place.
lusrmgr.msc (Local Users and Groups) on the PC that holds the filesAccounts-Full and Accounts-ReadSomeone leaves the office? Remove their account from the group — every folder is handled at once.
Auditing records who opened, changed or deleted a file — but only from the day it is switched on. It cannot look backwards.
secpol.msc → Advanced Audit Policy Configuration → Object Access → set Audit File System to Success (and Failure)Least privilege: give the smallest right that lets the person do their job — reading is not editing, and editing is not Full Control. No Everyone, ever: "Everyone" plus Full Control is the single most dangerous share setting in a small office. Accounts with passwords: every account that can reach a share needs a real password; Windows blocks blank-password accounts from network logon by default, and that protection should stay on.
The video walks through the complete sharing setup on a live PC — shares, permissions, groups and access control, exactly as an admin does it.
▶️ Watch Full VideoShare permissions guard the network door only and have three levels (Read, Change, Full Control). NTFS permissions are detailed, live on the drive itself, and apply to network and local users alike. For a network visitor, Windows applies whichever of the two is stricter.
No. NTFS permissions exist only on NTFS drives. FAT32 and exFAT (most pen drives and memory cards) have no Security tab at all — the share permission is the only lock there, which is one reason important shared folders belong on an NTFS partition.
No. Everything on this page — groups, NTFS permissions, auditing — works on a normal Windows 10 or 11 Pro PC in a workgroup. A domain simply lets one server manage the accounts for many PCs at once.