220-1102 Question 166
Single answerShared resourcesA small office uses a Windows 10 PC named ACCT-FS as a file server for the Accounting department. The folder C:\Accounting is shared on the network as AccountingShare. Users report that they can see the share and open it, but they receive an "Access denied" message when trying to save changes to files. You verify that the users are members of the Accounting security group. On the Share Permissions tab, the Accounting group has Change permission. On the Security (NTFS) tab, the Accounting group has Read & execute permission only. What is the BEST action to allow Accounting users to modify files in the shared folder while maintaining proper Windows security practices?
- A
Grant the Accounting group Modify permission on the Security (NTFS) tab for C:\Accounting
- B
Change the share permission for Everyone to Full Control and leave NTFS permissions unchanged
- C
Map the folder as a network drive using a different drive letter
- D
Disable password-protected sharing on ACCT-FS so users can save files without additional authentication
Show answer and explanation
Correct answer: A
Explanation
In Windows, access to shared folders is controlled by both share permissions and NTFS permissions. The user's effective permission is the most restrictive result of the two. In this scenario, the share permission (Change) would allow modification, but the NTFS permission (Read & execute) prevents writing. The best practice is to assign only the necessary rights and typically use NTFS permissions for detailed control. Granting the Accounting group Modify on the NTFS tab is the correct and least-privileged solution for a departmental shared resource. This aligns with Microsoft guidance on shared folder access, where both share and NTFS permissions must be evaluated together when troubleshooting access to shared resources.
- A. Correct.
Correct. Effective access to a shared folder is the most restrictive combination of share permissions and NTFS permissions. Even though the Accounting group has Change at the share level, they only have Read & execute at the NTFS level, so they cannot write or modify files. Granting Modify on the NTFS Security tab is the proper fix because it allows users to create, change, and delete files as needed while still avoiding unnecessary Full Control.
- B. Incorrect.
Incorrect. Setting the share permission for Everyone to Full Control does not solve the real problem because NTFS permissions still limit users to Read & execute. Also, giving Everyone Full Control is poor security practice because it broadly grants access beyond the intended group. In Windows environments, admins often use broad share permissions with tighter NTFS controls, but in this case NTFS must still be updated for the Accounting group to modify files.
- C. Incorrect.
Incorrect. Mapping the share to a drive letter only changes how users access the resource; it does not change underlying share or NTFS permissions. A user who lacks write access through permissions will still be unable to save changes whether the folder is opened through a UNC path or a mapped drive.
- D. Incorrect.
Incorrect. Disabling password-protected sharing affects how users authenticate to shared resources, primarily in simple sharing scenarios, but it does not override NTFS permissions. Since the users can already access the share and are authenticated members of the Accounting group, the problem is not authentication. The issue is insufficient file system permissions.