← All tutorials

Active Directory

Control shared folder access with Active Directory groups

Give each department its own folder, so that access follows the group rather than the individual.

Intermediate8 min read5 steps

  1. GroupOne per department
  2. FolderCreate and share
  3. PermissionsGrant to the group
  4. CheckTest both sides

What you need

  • A working domain with users and groups
  • A Windows Server domain member to hold the files
  • PowerShell opened as Administrator

  1. Create the folder

    Keep shared data off the system drive where possible, so it is simpler to back up and grow. This example uses a D: drive.

    New-Item -Path "D:\Shares\Finance" -ItemType Directory

  2. Share the folder

    This allows the Finance group and administrators to connect over the network. The share is only the first gate, and the folder permissions in the next step decide what each person can do.

    New-SmbShare -Name "Finance" -Path "D:\Shares\Finance" `
  -FullAccess "CORP\Domain Admins" `
  -ChangeAccess "CORP\Finance"

  3. Set the folder permissions

    The first command stops the folder inheriting broad permissions from its parent, while keeping copies of them. Then grant Modify access to Finance and remove access for ordinary users.

    icacls "D:\Shares\Finance" /inheritance:d
icacls "D:\Shares\Finance" /grant "CORP\Finance:(OI)(CI)M"
icacls "D:\Shares\Finance" /remove:g "BUILTIN\Users"
icacls "D:\Shares\Finance"

    Always review the final output of icacls. Changing permissions on a folder already in use can lock people out, so test on a new folder first.

  4. Map the drive for the department

    In Group Policy Management, create a policy and go to User Configuration, Preferences, Windows Settings, Drive Maps. Add \\SERVER\Finance, and use item-level targeting so that it appears only for members of the Finance group.

  5. Test as a member and a non-member

    Sign in as a Finance user and create a file. Then sign in as someone outside Finance and confirm they cannot open it. New group membership applies at the user's next sign-in.

Want this set up for your business?

We can plan, build and hand it over to your team.

Discuss your setup ↗
Next tutorialStrengthen passwords and handle employees who leave →