Setup Share Folders with NTFS Permission in Windows Server 2019

Summary

This tutorial video demonstrates various methods to create a shared folder in Windows Server 2019, enhancing accessibility for network users. It covers using Server Manager Console, File Explorer, and Computer Management Console, detailing each step from selecting the server and folder path to setting permissions for different user groups. The video also highlights the importance of configuring NTFS permissions and access-based enumeration for secure and controlled data sharing. By the end, viewers will understand how to effectively manage shared folders to improve collaboration within a network environment.

Takeaways

• 😀 The video demonstrates various methods to create a shared folder in Windows Server 2019.
• 🔧 Using Server Manager Console, you can create a new share folder by navigating through File and Storage Services, then Shares.
• 📁 Two default shared folders, 'Matlock' and 'SYSVOL', are automatically created when a server is promoted as a domain controller.
• 🖥️ The video shows selecting 'SMB Share - Quick' for general file sharing, which is one of the five available share profiles.
• 📂 Custom paths can be used to create a shared folder on a specific server, like the domain controller WS2019-01.
• 📝 When creating a share, it's important to name the share folder without spaces and provide a description if necessary.
• 👀 Enabling 'Access-based enumeration' prevents users from seeing files and folders they don't have permission to access.
• 🔄 'Allow caching of shares' is an option that allows offline users to access the content of the share folder.
• 🛠️ Customizing permissions involves disabling inheritance and setting explicit permissions for different users or groups.
• 👥 The video uses Active Directory Users and Computers to assign permissions to a security group for the shared folder.
• 🔄 The 'Creator-Owner' concept is explained, where users who create files or folders within the shared folder gain full control over them.
• 🔄 The video also covers using File Explorer and Computer Management Console as alternative methods to create shared folders.
• 🚫 It's noted that sharing permissions set in File Explorer can override NTFS permissions, emphasizing the importance of proper configuration.
• 💻 The final method mentioned is using the command line to create shared folders, though it's not demonstrated due to its complexity.

Q & A

What is the purpose of creating a shared folder in Windows Server 2019?

Creating a shared folder in Windows Server 2019 allows network users to access data stored on the server from their client computers, based on the permissions assigned to the shared folders.

How can you access the Server Manager console to create a new share folder?

To access the Server Manager console, you need to open it and navigate to the left-hand side where you will find 'File and Storage Services'. Click on that and then click on 'Shares' to see the list of current share folders.

What are share profiles and why are they used when creating a new share folder?

Share profiles are pre-configured settings that determine the type of sharing that is suitable for different needs. They are used to streamline the process of creating a new share folder and to ensure that the share is optimized for its intended use, such as general file sharing, advanced SMB share applications, or NFS sharing.

What is the 'SMB Share - Quick' profile used for?

The 'SMB Share - Quick' profile is used for general file sharing. It is suitable when you have a standard file server role installed on your server and you need to share files in a basic manner.

How do you specify the local path for a new shared folder?

To specify the local path for a new shared folder, you need to select 'Type a custom path', then click on 'Browse'. You will then be able to navigate to the desired location on the server's drives and select the folder you wish to share.

What is 'Access-based enumeration' and why is it enabled?

Access-based enumeration is a feature that prevents users from seeing files and folders they do not have permission to access. It is enabled to enhance security by ensuring that users only see and can access content they are permitted to view or use.

How can you customize permissions for a shared folder?

To customize permissions for a shared folder, you can click on 'Customize Permissions' during the share folder creation process. Here, you can disable inheritance and set explicit permissions for different users or groups.

What is the significance of disabling inheritance when setting permissions on a shared folder?

Disabling inheritance allows you to set unique permissions for the shared folder that are not inherited from parent folders. This ensures that the security settings for the shared folder are tailored to its specific needs and are not automatically applied from higher-level folder permissions.

How can you assign permissions to a specific department, such as HR, for a shared folder?

You can assign permissions to a specific department by using Active Directory Users and Computers to select the appropriate security group, such as 'Azure Users' for the HR department, and then granting them the desired permissions on the shared folder.

What happens when a user creates a file or folder under a shared folder with customized permissions?

When a user creates a file or folder under a shared folder with customized permissions, they become the 'creator-owner' of that file or folder. As the creator-owner, they have full control over the subfolders and files they create.

How can you confirm that a user can access and use the shared folder with appropriate permissions?

To confirm that a user can access and use the shared folder with appropriate permissions, you can log in as that user on a client computer and attempt to access the shared folder using its UNC path. You can then test creating, renaming, and deleting files and folders to verify that the permissions are correctly assigned.

What are the different methods to create a shared folder in Windows Server 2019 as mentioned in the script?

The script mentions three methods to create a shared folder in Windows Server 2019: using the Server Manager console, using File Explorer, and using the Computer Management console. Additionally, it mentions the command line method but does not go into detail as it is more complicated for permission assignments.

How does sharing a folder through File Explorer differ from sharing through the Server Manager console?

Sharing a folder through File Explorer is a more user-friendly method that involves right-clicking on the folder, selecting 'Properties', and then the 'Sharing' tab to share the folder. It allows for quick sharing with default permissions. In contrast, sharing through the Server Manager console provides more granular control over permissions and settings, suitable for more complex or secure sharing requirements.

Why is it important to specify NTFS permissions when creating a shared folder?

Specifying NTFS permissions is important because it allows you to control the access and actions that users can perform on the shared folder at the file system level. This ensures that users have the appropriate level of access and helps maintain the security and integrity of the data stored in the shared folder.

What is the impact of setting sharing permissions to 'Everyone Full Control' at the sharing level?

Setting sharing permissions to 'Everyone Full Control' at the sharing level allows every user to have full control over the shared folder, which can be a security risk. It is important to carefully consider who needs access and what level of access is appropriate to prevent unauthorized access and potential data breaches.

How can you manage permissions and other settings for a shared folder after it has been created?

After a shared folder has been created, you can manage its permissions and other settings by selecting the folder, right-clicking, and choosing 'Properties'. From there, you can access the 'Sharing' tab to manage sharing permissions and the 'Security' tab to manage NTFS permissions.