Technical Anshu
Tutorials Blog
👥 Groups Done Right

Give One User Read Only and Another Full Access to a Shared Folder

Same folder, two very different rights: one person edits freely, another can look but never change or delete a thing. Doing this with groups takes ten minutes and stays correct forever — doing it person by person becomes a mess within a month.

✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 8 minute setup
🎥 Full video — user groups and per-group access on shared folders

Every office reaches this moment: the billing folder is shared, the senior accountant must edit and delete, the new assistant must only read — and one wrong delete could cost a day of work. The wrong way is ticking boxes for individual people on five different screens. The admin way is two groups: build them once, and every future staff change is a one-line edit.

Local Users and Groups — lusrmgr.msc (example)
Groups on the file PC
Accounts-FullMembers: Ravi (senior)
Accounts-ReadMembers: Sana (assistant)
Folder D:\Billing — permissions
Accounts-FullShare: Change • NTFS: Modify
Accounts-ReadShare: Read • NTFS: Read and Execute
An example layout. Your names will differ — the structure is what matters.
1

Step 1 — Create the Two Groups

  1. On the PC that holds the folder, open lusrmgr.msc
  2. Right-click Groups → New Group — create one group per level of access, named by job: for example Accounts-Full and Accounts-Read
  3. Add the right people to each group while creating it

The same thing from Command Prompt (run as administrator):

net localgroup "Accounts-Full" /add
net localgroup "Accounts-Full" Ravi /add

2

Step 2 — Set the Share Permission by Group

  1. Open fsmgmt.msc → Shares → your share → Properties → Share Permissions
  2. Remove Everyone if it is there
  3. Add Accounts-Full with Change, and Accounts-Read with Read

Change (not Full Control) is the right share level for editors — nobody except an admin needs the power to alter permissions themselves.

3

Step 3 — Set the NTFS Permission by Group

  1. Folder Properties → Security → Edit
  2. Add Accounts-Full → tick Modify (this includes read, write and delete)
  3. Add Accounts-Read → tick Read & Execute and List folder contents only
  4. From Command Prompt, the same grant looks like this: icacls "D:\Billing" /grant "Accounts-Read":(OI)(CI)RX and icacls "D:\Billing" /grant "Accounts-Full":(OI)(CI)M

Remember the combination rule: network access is the stricter of the two lists, so both must agree with the plan.

4

Step 4 — Test as the Users, Not as Yourself

Administrators see everything, so your own test proves nothing. Log in as the assistant (or use a test account in the read group), open the share, and try three things: open a file (must work), save a change (must fail), delete a file (must fail). Then test the senior's account for the opposite. Only this test catches a wrong group membership or a stray Deny.

5

Step 5 — Living With It: Staff Changes in Seconds

When the assistant is promoted, you do not touch the folder at all — you move the account: net localgroup "Accounts-Read" Sana /delete then net localgroup "Accounts-Full" Sana /add. When someone leaves, remove their account from every group and disable the account. One honest note: a person must sign out and back in on their PC before a group change applies to them — Windows hands out group membership at logon.

🔴 Resist adding individuals directly to the folder “just this once”. Every exception is a future mystery: six months later nobody remembers why one person has special rights, and removing a leaver becomes guesswork. Groups keep the reason visible — the group name is the reason.

🎥 Watch the Full Video

The video demonstrates the full flow — creating groups, granting different levels, and testing what each user actually sees.

▶️ Watch Full Video
❓ Common Questions (FAQ)

Can the read-only user still copy files out of the folder?

Yes. Read permission includes copying — read-only stops changes to the originals, not copying. No Windows permission can let someone view a file but truly prevent copying it; if data must never leave, it should not be in a readable share.

What is the difference between Modify and Full Control?

Modify covers real work: read, write, rename and delete files. Full Control adds changing permissions and taking ownership — powers that belong to administrators, not daily users, however senior they are.

The user is in the right group but still cannot edit. Why?

Check in this order: did they sign out and back in after the group change, is the share permission also at Change level (both lists combine), and is there a Deny entry anywhere in the NTFS list for a group they belong to?

This guide is based on the Technical Anshu advanced sharing video • Stuck on any step? Ask in the video comments — you will get a reply there 🙏