The Shared Folder Access Puzzle
You are a support technician at a marketing firm with 50 employees. The company uses a Windows Server 2016 file server (FS01) with a shared folder called 'Campaigns'. Permissions are set as follows: Share permissions: Everyone = Full Control. NTFS permissions: Domain Admins = Full Control; Marketing Team = Modify; Contractors = Read & Execute. A new contractor, Alex, has been added to the Contractors group. Alex needs to edit files in a subfolder called 'Q3_Assets' within Campaigns. The Marketing Team has Modify permission on that subfolder. Alex reports that he can open files but cannot save changes. The IT manager suggests giving Alex Modify permission on the entire Campaigns folder, but you are concerned about security.
1. Explain why Alex cannot save changes, and propose a solution that follows the principle of least privilege.
Read the worked answer
Alex cannot save changes because NTFS permissions are cumulative, but the most restrictive applies when accessing over the network: Share permissions (Everyone Full Control) are overridden by NTFS permissions. Alex is in Contractors group, which has only Read & Execute on Campaigns. Even though Marketing Team has Modify on Q3_Assets, Alex is not a member of that group, so he only has Read & Execute inherited from the parent.
Solution: Grant Alex's account (or a new group for contractors needing edit access) Modify permission on the Q3_Assets subfolder only, not the entire Campaigns folder. This follows least privilege. Steps:
- Create a security group 'Q3_Contractors' and add Alex.
- On Q3_Assets, disable inheritance and copy existing permissions, then add Q3_Contractors with Modify.
- Ensure Share permissions remain Full Control (or change to Change for tighter control).
- Test access. Document the change.
2. What are the risks of granting Modify permission on the entire Campaigns folder to the Contractors group, and how would you mitigate them if the manager insists?
Read the worked answer
Risks:
- Contractors could accidentally or maliciously alter or delete files outside their project scope.
- Increased risk of data leakage if sensitive campaign data is stored there.
- Violation of least privilege and potential compliance issues.
Mitigation if manager insists:
- Enable auditing on the Campaigns folder to track changes.
- Implement a backup strategy with versioning (e.g., Volume Shadow Copy) for quick recovery.
- Use file screening or classification to restrict sensitive subfolders.
- Set up alerts for bulk deletions or modifications.
- Educate contractors on policies and require signed acceptable use agreement.
- Review permissions quarterly and remove access when contract ends.
Recommend a compromise: grant Modify only to a specific subfolder and use a test period with monitoring.