The NTFS has the capability to set user and group permissions on both folders and files

  • docs.netapp.com
  • ONTAP
  • ONTAP 9

10/22/2021 Contributors

To enable file access to the users or groups who have access to a share, you must configure NTFS file permissions on files and directories in that share from a Windows client.

Before you begin

The administrator performing this task must have sufficient NTFS permissions to change permissions on the selected objects.

About this task

SMB management and your Windows documentation contain information about how to set standard and advanced NTFS permissions.

Steps

  1. Log in to a Windows client as an administrator.

  2. From the Tools menu in Windows Explorer, select Map network drive.

  3. Complete the Map Network Drive box:

    1. Select a Drive letter.

    2. In the Folder box, type the SMB server name containing the share that contains the data to which you want to apply permissions and the name of the share.

      If your SMB server name is SMB_SERVER01 and your share is named “SHARE1”, you would enter \\SMB_SERVER01\SHARE1.

      The NTFS has the capability to set user and group permissions on both folders and files

      You can specify the IP address of the data interface for the SMB server instead of the SMB server name.

    3. Click Finish.

    The drive you selected is mounted and ready with the Windows Explorer window displaying files and folders contained within the share.

  4. Select the file or directory for which you want to set NTFS file permissions.

  5. Right-click the file or directory, and then select Properties.

  6. Select the Security tab.

    The Security tab displays the list of users and groups for which NTFS permission are set. The Permissions for <Object> box displays a list of Allow and Deny permissions in effect for the selected user or group.

  7. Click Edit.

    The Permissions for <Object> box opens.

  8. Perform the desired actions:

    If you want to…​.Do the following…​

    Set standard NTFS permissions for a new user or group

    1. Click Add.

      The Select User, Computers, Service Accounts, or Groups window opens.

    2. In the Enter the object names to select box, type the name of the user or group on which you want to add NTFS permission.

    3. Click OK.

    Change or remove standard NTFS permissions from a user or group

    In the Group or user names box, select the user or group that you want to change or remove.

  9. Perform the desired actions:

    If you want to…​Do the following

    Set standard NTFS permissions for a new or existing user or group

    In the Permissions for <Object> box, select the Allow or Deny boxes for the type of access that you want to allow or not allow for the selected user or group.

    Remove a user or group

    Click Remove.

    If some or all of the standard permission boxes are not selectable, it is because the permissions are inherited from the parent object. The Special permissions box is not selectable. If it is selected, it means that one or more of the granular advanced rights has been set for the selected user or group.

  10. After you finish adding, removing, or editing NTFS permissions on that object, click OK.

When it comes to sharing resources on a network, the first and foremost concern is who will have access to those resources and at what levels. Managing file servers in an Active Directory (AD) environment can be tedious, and the fact that it has to be done one user at a time makes it one of the most time-consuming activities for a system administrator.

For example, say a new employee has joined the HR team in your organization. You will want to give them access to shared resources such as staff details, HR policies, company policies, and more, but at the same time, giving them access to financial data is unnecessary and could lead to mislocation, tampering, or misuse of data. As another example, you never want to give a new employee delete permissions on any resource. This is why you need to put a few confinements to the level of access for users in place. You can do this by carefully defining the user's access control entries.

Another aspect to consider apart from security is that while the availability of more options for hardware has certainly driven down storage and server costs, the cost of maintenance continues to rise steadily. The reasons for this span from more data being continually stored to server outages and data corruption. These all point to lack of proper file server management and maintenance measures. ADManager Plus offers an efficient, one-stop solution to this problem with file server management and reporting capabilities for Active Directory as well as Isilon and NetApp servers.

The file server management feature in ADManager Plus empowers administrators to manage (i.e., assign, modify, and revoke) users' NTFS and share permissions in bulk. All you have to do is choose the shared resource, and then scrutinize and define the access controls of users based on their needs. By using ADManager Plus' file server management capabilities, admins can:

  • Give users and groups access to required resources without security risks.
  • Perform bulk modification of permissions.
  • Apply different types of permissions and limit the scope to particular folders and sub-folders.
  • Manage permissions on Active Directory, NetApp, and Isilon file servers.
  • Carry out all these tasks from a simple, single, central window

ADManager Plus offers four areas of operations in the file server management section. They are:

  • Modify NTFS Permissions - Define the actions users can take on folders and files on the network and locally.

    The tool offers the following NTFS permissions modification options:

    • Include all inheritable permissions from a particular object's parent.
    • Remove all existing permissions and apply only a specific set of permissions.
    • Replace all existing inheritable permissions on all descendants with inheritable permissions from a particular object.

    You can also apply advanced permissions such as read or write extended attributes and take ownership of the file or folder, and limit the permissions to a specific folder or a sub-folder.

  • Remove NTFS Permissions - Revoke NTFS permissions.
  • Modify Share Permissions - Determine what type of access others will have on the shared folder.
  • Remove Share Permissions - Revoke share permissions.

While modifying NTFS permissions, you can also list existing shared folder permissions on a specific folder. The copy from folder option makes modifying NTFS permissions even more effortless by letting you copy permissions on another folder and apply them to the desired folder. The Preview option lists the permission changes so that you can verify them before they are updated.

The NTFS has the capability to set user and group permissions on both folders and files

The revoking section of operations come in handy in scenarios where an employee leaves the organization. The admin does not have to stew over what permissions to revoke on what shares. All they have to do is choose the user account (say Bob) and under permissions choose any permission (in this case all permissions as the employee is leaving) and then type deny. His job is done in no time with no mess.

You can even delegate file permissions management to any user with the help desk delegation feature of ADManager Plus. You can also track permission changes of shared folders and file servers with the built-in audit reports. The technician and admin audit reports can be exported to CSV, PDF, HTML, or Excel format as needed.

In addition to this, ADManager Plus also has reports on NTFS permissions configured on AD, NetApp, and Isilon file servers such as Shares in the Servers, Permissions for Folders, Folders accessible by Accounts, and Non-Inheritable Folders. These reports give admins immediate visibility into access controls in a comprehensive way. This immediate visibility into permissions can help admins effectively enhance security.

Benefits of using ADManager Plus for AD file permissions management:

  • Perform bulk administration of permissions for multiple folders at once.
  • Provide just-in-time access and just enough permissions in only a few mouse clicks.
  • Delegate AD file server permissions management to technicians securely.

Stay on top of permission and access management with ADManager Plus.

Thanks!

Your download is in progress and it will be completed in just a few seconds!
If you face any issues, download manually here

Featured links

  • Active Directory NTFS reports
  • Active Directory NTFS shares reports
  • Active Directory security reports
  • Microsoft 365 User Reports

  • Folder permissions and access reports
  • Active Directory SOX compliance reports
  • Active Directory Management
  • Microsoft 365 Management

Other features

Bulk User Management

Fire a shotgun-shell of AD User Management Tasks in a Single Shot. Also use csv files to manage users. Effect bulk changes in the Active Directory, including configuring Exchange attributes.

Active Directory Logon Reports

Monitor logon activities of Active Directory users on your AD environment. Filter out Inactive Users. Reporting on hourly level. Generate reports for true last logon time & recently logged on users.

Active Directory Computer Reports

Granular reporting on your AD Computer objects to the minutest detail. Monitor...and modify computer attributes right within the report. Reports on Inactive Computers and operating systems.

Active Directory Workflow

A mini Active Directory ticket-management and compliance toolkit right within ADManager Plus! Define a rigid yet flexible constitution for every task in your AD. Tighten the reins of your AD Security.

Active Directory Cleanup

Get rid of the inactive, obsolete and unwanted objects in your Active Directory to make it more secure and efficient...assisted by ADManager Plus's AD Cleanup capabilities.

Active Directory Automation

A complete automation of AD critical tasks such as user provisioning, inactive-user clean up etc. Also lets you sequence and execute follow-up tasks and blends with workflow to offer a brilliant controlled-automation.

Need Features? Tell Us
If you want to see additional features implemented in ADManager Plus, we would love to hear. Click here to continue

What specific part of the operating system receives requests for shared network resources and makes these resources available to a network client?

A server is a software or hardware device that accepts and responds to requests made over a network. The device that makes the request, and receives a response from the server, is called a client.

Which file system supports encryption compression and the use of volumes?

NTFS—the primary file system for recent versions of Windows and Windows Server—provides a full set of features including security descriptors, encryption, disk quotas, and rich metadata, and can be used with Cluster Shared Volumes (CSV) to provide continuously available volumes that can be accessed simultaneously from ...

Which firewall rule group must be enabled in order to allow for the remote use of the Task Scheduler snap in?

To enable Remote Administration in Windows Firewall, use the command netsh advfirewall firewall set rule group=”Remote Administration” new enable=yes. This will enable remote management for any MMC snap-in.

Which of the following is a new feature in Windows Server 2016 that enables block level?

Storage Replica, a feature new to Server 2016, enables storage-agnostic, block-level synchronous replication between servers or clusters for disaster preparedness and recovery.