Fix SMB Share Access Denied by Separating Share and NTFS Permissions

Before you begin

Applicable to supported Windows Server/client environments where the named role or feature is installed. Run read-only checks first from an elevated PowerShell or Command Prompt as appropriate. Replace example hostnames, domain names, addresses, ports and paths with values from the affected environment. Record the exact error, timestamp, OS build and scope of impact.

Production safety: obtain change approval and a verified backup before modifying AD DS, DNS, DHCP, firewall, IIS, storage or Hyper-V configuration. Ensure console/out-of-band access before network or remote-access changes.

Symptoms and likely root cause

A user sees a share but receives Access Denied when opening or modifying files.

Share ACL and NTFS ACL combine; group token may be stale; explicit deny, inheritance, EFS or wrong cached credentials may apply.

Diagnostic commands

Get-SmbShare -Name Accounts
Get-SmbShareAccess -Name Accounts
icacls D:\Shares\Accounts
whoami /user
whoami /groups
Get-SmbSession | Select ClientComputerName,ClientUserName,NumOpens

Run the commands in order and save the complete output. The commands above are intended to establish the failing layer before a configuration change is attempted.

How to interpret the results

Verify exact server path and share ACL, then NTFS ACL on the failing child folder/file. Explicit Deny can override allow. Recent group membership changes require sign-out/sign-in to refresh the token.

Practical correction

Use a dedicated AD security group and minimum required share/NTFS permissions. Example share ACL only: Grant-SmbShareAccess -Name Accounts -AccountName CORP\Finance-Modify -AccessRight Change -Force. Apply NTFS ACL separately under the organisation standard.

Make one change at a time. Re-run the failed diagnostic after each change so the cause-and-effect relationship is clear.

Fallback and recovery

Save ACL first: icacls D:\Shares\Accounts /save C:\Temp\Accounts-acl.txt /T /C. Restore through a reviewed plan if permissions broaden. Test Read/Modify/Delete with authorised and unauthorised users.

Verification checklist

Success: intended group can perform only approved operations; other users remain denied. Share Full Control alone does not override NTFS restrictions.

• Repeat the original failing operation from the affected client/user or service.
• Test from a second approved endpoint or subnet where relevant.
• Review the relevant event log/IIS log after the fix.
• Record the change, actual result and any remaining limitation.

Frequently asked question

Does share Full Control mean all users can edit files? No. NTFS permissions also apply.

Official technical reference

Microsoft Learn — troubleshoot smb guidance

Use the official documentation for exact version support, prerequisites and any procedure that differs between Windows Server releases.

Technician field note

This runbook describes a controlled diagnostic path; it is not a universal guarantee that every environment has the same cause. If evidence does not match the expected result, stop and investigate rather than applying unrelated fixes. Do not mark the incident resolved until the original symptom is verified as cleared.