In a perfect world, shared folders have specific permissions granted to one or more security groups that contain the user community for that share. The user community is known and authorized by the data owner. Users can be added to and removed from the security groups to manage the user community.
In the real world, we often have shares for which we really don’t know the user community because the data owners have granted permissions to the Everyone or Authenticated Users group. Everything is fine until an auditor or a changing security requirement necessitates the setting of more restricted permissions. Sometimes so much time has passed with unrestricted permissions that the data owner has no idea of who might be using the resources on the share.
Tightening share permissions can be risky. It seems that no matter how carefully you plan, some problems occur, resulting in a flood of Help desk calls from users receiving Access denied messages. A further complication is that if you're dealing with multiple campuses or domains, you can have an even larger unidentified remote user community that you're dealing with. . . .
Register
