How to Set Shared Folder Permissions on Windows

This guide explains how to define access rights on shared folders in Windows, a key part of keeping files accessible to the right people while protecting them from unauthorized access. You’ll learn the difference between share permissions and NTFS permissions, how to configure both, and how to avoid common pitfalls that can lock users out or expose data unintentionally.

What You’ll Need

• A Windows PC (Windows 10 or 11) with an administrator account.
• The folder you want to share, already created on a local drive (e.g., C:\Users\Public\SharedDocs).
• The names of the users or groups that need access (these can be local accounts or domain accounts).
• If the folder is on a network, ensure the computer is on the same network and file sharing is enabled in Network & Sharing Center.

Step-by-Step

1. Open the folder’s Properties. Right-click the folder you want to share and select Properties.
2. Go to the Sharing tab. In the Properties window, click the Sharing tab. Here you’ll see two sections: Network File and Folder Sharing and Advanced Sharing.
3. Start the sharing wizard (optional). Click the Share… button in the Network File and Folder Sharing section. This opens a simple wizard where you can pick users from a drop-down list, set their permission level (Read or Read/Write), and click Share. This is the quickest way for basic needs, but it only sets share permissions, not NTFS permissions.
4. For more control, use Advanced Sharing. Click Advanced Sharing… in the same tab. Check the box Share this folder.
5. Set a share name. In the Share name field, type a name that network users will see. You can also add a comment (optional).
6. Configure share permissions. Click Permissions in the Advanced Sharing window. By default, the Everyone group has Read access. To change this, select Everyone and click Remove, or adjust the permissions. Then click Add… to add specific users or groups.
7. Add users or groups. In the Select Users or Groups dialog, type the user name (e.g., John or Domain\John) and click Check Names to validate. Click OK.
8. Set share permission level. Select the added user and check the appropriate boxes under Permissions: Full Control, Change, or Read. Read allows viewing and opening; Change adds the ability to modify, add, and delete files; Full Control includes all of that plus changing permissions and taking ownership. Click OK to close.
9. Set NTFS permissions. While still in the folder’s Properties, go to the Security tab. This is where NTFS permissions are managed. Click Edit… to change permissions.
10. Add users for NTFS permissions. In the Permissions dialog, click Add… and type the user or group name, then click OK.
11. Assign NTFS permissions. With the user selected, check the boxes under Allow for the permissions you want to grant: Full control, Modify, Read & execute, List folder contents, Read, or Write. Read & execute is a good default for most users. Click OK to apply.
12. Apply and close. Click Apply and then OK on all open dialog boxes to save your changes.
13. Test the access. From another computer, try accessing the share via the network path (e.g., \\ComputerName\ShareName) using the credentials of a user you’ve granted access to. Verify they can only do what you’ve allowed.

Common Mistakes

• Only setting share permissions and ignoring NTFS permissions. The effective access is the more restrictive of the two. If you give Full Control in share permissions but NTFS only allows Read, the user gets Read.
• Leaving ‘Everyone’ with Read or Full Control. This can expose sensitive data to anyone on the network. Always remove ‘Everyone’ and add specific users or groups.
• Using the wrong user list. When adding users, make sure you’re adding the correct domain or local accounts. Typos can result in access being denied.
• Not considering inheritance. NTFS permissions are inherited from parent folders by default. If you want to block access, you may need to disable inheritance and copy or remove inherited permissions.
• Forgetting to reapply after moving a folder. Moving a folder within the same volume preserves permissions, but moving it to a different volume may reset them.

Tips

• Use groups instead of individual users whenever possible. For example, create a group called ‘Sales’ and assign permissions to that group. This makes management much easier.
• Set share permissions to ‘Full Control’ for everyone, and rely on NTFS permissions to restrict access. This simplifies the model and reduces confusion.
• For read-only access, give ‘Read’ in both share and NTFS. For read/write, give ‘Change’ in share and ‘Modify’ in NTFS.
• Use the ‘Effective Access’ tab in the Security settings (under Advanced) to check what a specific user actually gets.
• Document your permission scheme, especially if multiple people manage the server.

Troubleshooting

• Users can’t access the share at all. Check that the folder is shared (the Sharing tab shows the network path). Also verify that the user has both share and NTFS permissions. If the user is on a different domain, ensure the computer is on the same network and that file sharing is enabled.
• Users can see the folder but can’t open it. This usually means NTFS permissions are too restrictive. Check the Security tab and grant at least ‘Read’ to the user or group.
• Users can open files but can’t modify them. Ensure the user has ‘Change’ in share permissions and ‘Modify’ in NTFS permissions.
• Access denied even though permissions seem correct. Check for inherited permissions that may be blocking. Go to Security > Advanced > Disable inheritance, and then add explicit allow rules. Also make sure the user is not being denied by a group they belong to.
• Changes don’t take effect. Permissions changes are usually immediate, but sometimes a user may need to log off and on again or disconnect and reconnect to the share.
• Can’t share the folder. Make sure the computer is not part of a HomeGroup (deprecated) and that network discovery is on. Also, check that the ‘File and Printer Sharing’ firewall rule is enabled.

Frequently Asked Questions

What is the difference between share permissions and NTFS permissions?

Share permissions apply only when the folder is accessed over the network. NTFS permissions apply both locally and over the network. The effective access is the most restrictive combination of the two.

Should I use share permissions or NTFS permissions?

For most scenarios, it’s best to set share permissions to ‘Full Control’ for everyone and then use NTFS permissions to control specific access. This simplifies management and avoids conflicts.

How do I give a user read-only access?

Grant ‘Read’ in both share permissions and NTFS permissions. In share permissions, ‘Read’ is the default. In NTFS, check ‘Read’ or ‘Read & execute’.

Can I set permissions for a group that includes domain users?

Yes. When adding users or groups, you can type the domain group name (e.g., ‘Domain\Sales’) and it will be recognized. The same applies to local groups.

What does ‘Full Control’ in NTFS include that ‘Modify’ doesn’t?

‘Full Control’ includes all ‘Modify’ permissions plus changing permissions, taking ownership, and deleting subfolders and files even if the user doesn’t have ‘Delete’ on the folder itself.

Why do I get an ‘Access Denied’ error even though I’m the administrator?

Administrators may be subject to User Account Control (UAC). When accessing a share, you may need to provide elevated credentials or disable simple file sharing. Also, if the folder is on a different machine, you need proper permissions on that machine.

Related

• Best qBittorrent Settings for Speed & Privacy
• N+1 Query Problem: What It Is & How to Fix It
• Excel FILTER Function: When to Use It