220-1102 Question 376
Single answerNTFS vs. share permissionsA technician is troubleshooting access to a shared folder on a Windows file server. The folder D:\Projects is shared as \FS1\Projects. The share permissions for the Everyone group are set to Read. The NTFS permissions on D:\Projects give the Accounting group Modify access. User Kim is a member of Accounting and can open and edit files when logged on locally at the server, but when connecting over the network to \FS1\Projects, Kim can only open files and cannot save changes. What should the technician do to allow Kim to edit files over the network while still limiting access to authorized users?
- A
Change the share permission from Everyone: Read to Everyone: Change
- B
Change the NTFS permission for Accounting from Modify to Full Control
- C
Remove the share and instruct Kim to use Remote Desktop to edit files locally
- D
Add Kim directly to the local Administrators group on the server
Show answer and explanation
Correct answer: A
Explanation
In Windows, shared folder access over the network is controlled by both share permissions and NTFS permissions. The effective permission is the most restrictive combination of the two. In this scenario, NTFS grants Kim Modify through the Accounting group, so Kim can edit files locally. However, network access is restricted by the share permission of Everyone: Read, which reduces Kim's effective network access to read-only. The proper fix is to make the share permission less restrictive, commonly by assigning Change at the share level, while using NTFS permissions to provide detailed security. This follows Microsoft best practices: use broad share permissions as needed for network access and rely on NTFS permissions for granular control. A common administrative approach is to set the share to Change or Full Control for appropriate groups and then carefully manage NTFS permissions on the folder.
- A. Correct.
Correct. When a user accesses a folder across the network, both share permissions and NTFS permissions apply, and the most restrictive effective permission is used. Kim already has NTFS Modify through the Accounting group, which is sufficient to edit files. However, the share permission of Everyone: Read limits network access to read-only. Changing the share permission to Change allows network-based modification while NTFS permissions continue to restrict actual access to authorized users such as Accounting.
- B. Incorrect.
Incorrect. NTFS Modify already allows creating, changing, and deleting files and folders in most standard file-sharing scenarios. Increasing NTFS to Full Control is unnecessary and grants additional rights, such as changing permissions, that are not required for Kim to edit files. The real limitation is the share permission, not the NTFS permission.
- C. Incorrect.
Incorrect. While Remote Desktop would let Kim work locally and bypass the share permission issue, it is not the appropriate fix for a file share permission problem. This option also changes the workflow unnecessarily and does not follow the best practice of correcting the underlying permission configuration.
- D. Incorrect.
Incorrect. Adding Kim to Administrators would likely allow access, but it is excessive and violates least-privilege best practices. Administrative membership should not be used to solve standard file access issues. The problem can be resolved by adjusting the share permission appropriately.