File servers are still a crucial part of many organizations’ IT infrastructure, despite the growing adoption of cloud services. In fact, they’re here to stay – at least for now. This is because companies value the control and cost-effectiveness that on-premises storage offers, especially when it comes to sensitive or large volumes of data.
One key challenge with file servers is access governance: ensuring that only authorized personnel can access company files and data. With the level of control that on-premises infrastructure affords, it’s essential to get this right. A single misstep can lead to security breaches, data loss, or compliance issues down the line.
To manage file servers securely, administrators need to follow some best practices. The first is to avoid assigning permissions directly to users. Instead, use dedicated security groups that clearly indicate what access they’re granting. For example, instead of giving a user direct permission to access the finance directory, create a group called ‘fs_finance_read’ and add the user to it.
This approach has several benefits. Firstly, it makes tracking and managing permissions much easier. When you inspect a user’s object, their membership in various groups is visible, making it clear what resources they have access to. In contrast, direct permission assignments are often hidden within folder properties, making them difficult to track, especially in large environments.
Another best practice is to use the AGDLP model for organizing permissions. This stands for accounts, global groups, domain local groups, and permissions. By layering groups in this way, you can create a hierarchical structure that makes it easy to manage access control. For instance, instead of adding users directly to permission groups, add them to a global group that corresponds to their role (e.g., sales or customer support). Then, make that global group a member of the individual permission groups for each resource they need access to.
This model not only streamlines access governance but also enables you to implement role-based access control for file server and Active Directory resources. By following this approach, you can ensure that users have the right level of access without having to manually manage permissions for every single user.
Finally, when it comes to share permissions and NTFS controls, prioritize using NTFS permissions to govern access. While share permissions are convenient for controlling network access, NTFS offers more granular control over permission levels, including both local and network access. By setting share permissions leniently (e.g., Change for users) and relying on NTFS permissions to restrict access further, you can strike the right balance between accessibility and security.
To summarize: file servers are here to stay, but their management requires a solid understanding of access governance best practices. By using dedicated security groups, implementing the AGDLP model, and prioritizing NTFS permissions, administrators can protect their organization’s data while maintaining control over sensitive resources.
Source: Bleeping Computer — 2026-08-31