Windows Small Business Server 2011 : Working with Permissions (part 1) - Using Share Permissions

1. Using Share Permissions

The share permission system is the simplest of the permission systems in Windows Server 2008 R2. It functions just like the NTFS and other permission systems in Windows, except that there are only three permissions you can assign. As with the other permission systems, you can allow or deny each of the permissions to any security principal available on the system or in the domain. Table 1 lists the three share permissions and the tasks they enable users to perform.

Table 1. Share Permissions and Associated Tasks

SHARE PERMISSION	ALLOWS OR DENIES SECURITY PRINCIPALS THE ABILITY TO:
Full Control	Change file permissions Take ownership of files Perform all tasks allowed by the Change permission
Change	Create folders Add files to folders Change data in files Append data to files Change file attributes Delete folders and files Perform all actions permitted by the Read permission
Read	Display folder names, file names, file data, and attributes Execute program files Access other folders within the shared folder

Assigning the Allow Full Control share permission to everyone is a simple solution that, on a small business network, is typically successful in removing the share permission system from everyone’s consideration. There are certain inconveniences that are possible as a result—someone could conceivably take ownership of a share and deny everyone else all permissions to it—but this is a futile gesture because there is nothing to stop you, or anyone else, from taking ownership back and revoking those permissions.

When you create a new share using the Provision A Shared Folder Wizard, the SMB Permissions page, shown in Figure 1, enables you to select from three preconfigured share permission assignments, none of which is equivalent to the Allow Full Control for Everyone assignment that Windows SBS 2011 uses for its default shares. However, when you select the Users and groups have custom share permissions option and click Permissions, a Permissions dialog box for the share appears, enabling you to assign any permissions you want.

Figure 1. The SMB Permissions page of the Provision A Shared Folder Wizard.

This same Permissions interface is accessible from the shared folder’s Properties sheet. To assign the Allow Full Control permission to a folder share that you have already created, use the following procedure:

1. Log on to your Windows SBS 2011 server using a domain account with administrative privileges.

2. Open Windows Explorer and browse to the shared folder you want to manage.

   

3. Right-click the shared folder and, from the context menu, select Properties. The Properties sheet for the folder appears.

   

4. Click the Sharing tab.

   

5. Click Advanced sharing. The Advanced Sharing dialog box appears.

   

6. Click Permissions. The Permissions dialog box for the share appears.

   

   Note

   This is the same Permissions dialog box that appears when you select the Users and groups have custom share permissions option in the Provision A Shared Folder Wizard.

7. In the Group or user names list, select Everyone.

8. In the Permissions for everyone box, select the Allow full control check box and click OK.

9. Click OK to close the Advanced Sharing dialog box.

10. Click OK to close the Properties sheet.

11. Close Windows Explorer.