For future reference when I inevitably forget whether it is more appropriate to restrict folders with NTFS permissions (Security tab) or file share permissions (Sharing tab).
“For example, some experienced administrators prefer always to set share permissions to Full Control for Everyone, and to rely entirely on NTFS permissions to restrict access.”
Relevant table of examples:
| Folder type | Share permissions | NTFS permissions |
|---|---|---|
| Public folder. A folder that can be accessed by everyone. | Grant Change permission to the Users group. | Grant Modify permission to the Users group. |
| Drop folder. A folder where users can drop confidential reports or homework assignments that only the group manager or instructor can read. | Grant the Change permission to the Users group.
Grant the Full Control permission to the group manager. |
Grant the Write permission for the users’ group that is applied to This Folder only. (This is an option available on the Advanced page.) If each user needs to have certain permissions to the files that he or she dropped, you can create a permission entry for the Creator Owner well-known security identifier (SID) and apply it to Subfolder and files only. For example, you can grant the Read and Write permission to the Creator Owner SID on the drop folder and apply it to all subfolders and files. This grants the user who dropped or created the file (the Creator Owner) the ability to read and write to the file. The Creator Owner can then access the file through the Run command using \\ServerName\DropFolder\FileName. Grant the Full Control permission for the group manager. |
| Application folder. A folder containing applications that can be run over the network. | Grant Read permission for the Users group. | Grant Read, Read and Execute, and List Folder Content permissions to the Users group. |
| Home folders. Individual folders for each user. Only the user has access to the folder. | Grant the Full Control permission to each user on their respective folder. | Grant the Full Control permission to each user for their respective folder. |