guide · static export
Security

Share a Folder on Your LAN With SMB and Correct Permissions

A share that half the house can read and nobody can write is a permissions problem, not a network problem. Set the share and the NTFS side once, deliberately.

by@guidox updated:10/31/26 time:35 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11
TL;DR

Create a local group for the people who should write, share the folder to that group only, then set **NTFS** permissions to match. Windows applies the **most restrictive** of the two.

Before you start

Requirements

  • Two Windows PCs on the same network
  • Admin rights on the host
  • A folder outside the user profile
Step by step

Instructions

01

Separate share and NTFS permissions

A share has its own permission list, and so does the folder on disk. Access needs both, and the effective right is the stricter one. Confusing the two is why a folder is writable for one account and read-only for another.

⚠ warningNever grant **Everyone** on both sides to make it work. That is the shortcut that turns one mistake into a house-wide problem.
02

Create the accounts and one group

Give each person a local account and put them all in a single group. Per-person accounts keep the audit trail readable and let you revoke access for one device without touching the rest.

net user family Pa55w0rd! /add
net localgroup smb-users /add
net localgroup smb-users family /add
03

Share the folder to the group

Right-click the folder, open **Properties > Sharing > Advanced Sharing**, tick the box and open **Permissions**. Remove **Everyone** and add the group with **Change** so members can write and delete.

Share name: share
Permissions: smb-users -> Change
tipRead is enough for a media folder that nobody edits. Add write rights only where people really store work.
04

Fix the NTFS side

On the **Security** tab disable inheritance, convert the inherited entries, then add the same group with **Modify**. Without this step the share says yes and the folder says no, which reads as a random failure from the client.

05

Turn sharing on for the private profile

Network discovery and file sharing must be on for the **Private** profile. On a **Public** profile Windows blocks both, and a home network ends up labelled public after many router changes.

Settings > Network & internet > Ethernet > Network profile type
06

Connect from the other PC with stored credentials

Map the share with credentials so it reconnects after a reboot, then test by writing a file from the client. Browsing the folder in Explorer proves less than one successful write.

net use Z: \\HOSTNAME\hare /user:HOSTNAMEamily /persistent:yes
tipUse the computer name, not the IP. A new DHCP lease then does not break the mapping.
Troubleshooting

Common issues

Access is denied although the share allows it

The NTFS tab is stricter. Open the Security tab and check the group's effective rights on that exact folder, not on the parent.

The other PC cannot see the computer

Network discovery is off or the profile is Public. Set the profile to Private and allow File and Printer Sharing in the firewall.

The mapped drive disappears after a reboot

The mapping was made without stored credentials. Recreate it with /persistent:yes and tick Remember my credentials in the dialog.

Transfers crawl at 10 MB/s

The link negotiated at 100 Mbit or Wi-Fi is in power saving. Check the adapter speed and use Ethernet for large copies.

FAQ

Frequently asked

Should I enable SMB1?

No. SMB1 is disabled for good reasons and every Windows 10 and 11 build speaks SMB2 or 3.

Can I share without a password?

Only by allowing insecure guest logons, which weakens the whole network. Use accounts instead.

How to undo this

Stop sharing the folder in **Advanced Sharing**, then remove the group and the local accounts you created. The files themselves stay where they are.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress