Every shared folder in Windows is guarded by two different systems with confusingly similar names. Once you see what each one controls — and the one rule Windows uses to combine them — every sharing problem becomes easy to reason about.
Share permissions and NTFS permissions look alike: both list users, both say Allow. But they live in different places, protect different doors, and Windows always applies the stricter of the two for network visitors. This page separates them once, clearly, with one worked example you can reuse for every folder you ever share.
The share permission is set on the Sharing tab (or in fsmgmt.msc) and is checked only when someone arrives over the network. It knows nothing about files inside — it guards the share as a whole. It has just three levels: Read (open and copy out), Change (also edit, add and delete files), and Full Control (Change plus changing permissions). Sit down at the PC itself and this list is never consulted.
NTFS permissions are stored with the files on the drive and set on the Security tab. They apply to everyone — network visitors and people logged in at the keyboard. They are far more detailed: Read, Read & Execute, Write, List Folder Contents, Modify (the normal "full working access" for staff) and Full Control, plus thirteen special permissions underneath, per-file if you really need that. Move the drive to another PC and the NTFS list travels with it; the share list does not.
For a network visitor, Windows works out both lists and applies the smaller right. Share Full Control + NTFS Read = Read. Share Read + NTFS Full Control = Read. There is no way to "boost" a weak NTFS list with a generous share list. This is why experienced admins pick one of two styles and stay consistent:
Both are legitimate. Mixing them randomly is how "access denied" mysteries are born.
Three details decide real-world cases. Deny beats Allow — an explicit Deny on any group the user belongs to overrides their Allows, so use Deny rarely and deliberately. Inheritance — folders copy their parent's list by default; the Security tab's Advanced screen shows where each entry came from. Moving files — a file moved within the same drive keeps its permissions; a file copied, or moved to another drive, inherits the destination folder's list. That last one explains many "the file was protected, now everyone can open it" surprises.
In the video you can watch both permission screens side by side on a live machine, with users getting different rights on the same folder.
▶️ Watch Full VideoOnly the NTFS permission. Share permissions are checked exclusively for network access — logging in locally never passes through the share layer.
No. For network users the effective right is the more restrictive of the two, so a generous share setting can never exceed what NTFS grants.
Because NTFS permissions require an NTFS file system. Pen drives are usually FAT32 or exFAT, which have no permission storage at all — anyone holding the drive can read everything on it, whatever the share said.