File sharing between employees is one of the most common needs in any organization — but the key point is that this sharing must be controlled, not open to everyone for everything. In this tutorial, we'll walk through setting up a File Server with two layers of permissions (Share and NTFS).
Step 1: Install the File Server role
From Server Manager, go to Add Roles and Features. Under Server Roles, open File and Storage Services > File and iSCSI Services and check File Server (on many server versions, this role is already installed by default).
Step 2: Create a folder and set NTFS permissions
Create a folder — e.g., D:\Shared\Accounting. Right-click it, open Properties, and go to the Security tab:
Click Edit.
Add the target group or user (e.g., a security group named Accounting-Team).
Set the access level — Modify is usually enough (read, write, and edit, but not changing permissions).
NTFS Permissions apply even when a user accesses the file directly on the server itself — this is the "always-on" layer of file security.
Step 3: Share the folder (Share Permissions)
Now let's make that same folder available over the network:
Right-click the folder, open Properties > Sharing > Advanced Sharing.
Check Share this folder.
Click Permissions and add the same group (Accounting-Team) with Change access.
Step 4: Understand the difference between NTFS and Share Permissions
This is where a lot of beginners get confused: when a user accesses a folder over the network, both sets of permissions (Share and NTFS) are checked, and the stricter one wins. For example, if Share Permission says Full Control but NTFS Permission says Read only, the user ends up with Read only.
Because of this, the best practice is: give Everyone Full Control in Share Permissions, and manage actual access control entirely through NTFS Permissions — this makes management much simpler.
Step 5: Test access
From another client computer on the same domain, enter the network path:
\\server-name\Shared
If you're logged in with an account that's a member of Accounting-Team, you should have access to the folder; with a different account, access should be denied.
This is exactly the kind of practical skill every enterprise network admin uses daily — and a key part of my MCSA courses.
Blog