As organizations continue to navigate the complex world of data storage and management, one thing is clear: file servers are here to stay. Despite predictions of a cloud-only future, many businesses are opting to maintain on-premises file servers alongside their SaaS subscriptions, citing concerns about cost control, risk ownership, and regulatory demands. Whether it’s due to soaring cloud costs or the need for legacy compatibility, file servers remain an essential part of many IT infrastructures.
One of the main reasons why file servers persist is that they offer a level of control and risk ownership that cloud services can’t match. With on-premises infrastructure, organizations have full control over cost, retention, backups, and access – but this also means that effective access governance is crucial to protecting sensitive data. In other words, without proper management, file servers can quickly become a security liability.
To mitigate these risks, cybersecurity professionals recommend implementing five best practices for managing file servers securely. The first principle is simple yet often overlooked: never assign permissions directly to users. Instead, use dedicated security groups that follow a consistent naming scheme, such as “fs_finance_read”. This approach provides several benefits: it makes permission tracking easier, and it allows administrators to see all the resources a user has access to.
A related best practice is to nest permission groups using the AGDLP (accounts, global groups, domain local groups, permissions) model. By creating global groups that map to different roles within an organization, and then making these groups members of individual permission groups, administrators can provide new users with all the necessary access simply by adding them to the correct role group. This approach streamlines access governance significantly and is a key component of role-based access control.
When it comes to share permissions, many administrators prefer to use NTFS (New Technology File System) permissions instead. This is because NTFS permissions apply to both network and local access, and provide more granular control over permission levels. By setting share permissions leniently – such as Change for users and Full Control for admins – and relying on NTFS permissions to govern access, administrators can ensure that sensitive data remains protected.
In addition to these best practices, it’s essential to clean up group structures and improve visibility. This can be achieved by implementing a consistent naming scheme and avoiding the creation of unnecessary groups or permissions. By taking these steps, administrators can reduce their workload and lower the risk of security breaches associated with file servers.
Ultimately, managing file servers securely requires attention to detail, careful planning, and a commitment to best practices. By following these guidelines and staying vigilant, organizations can ensure that their on-premises infrastructure remains secure and compliant – even as they navigate the complexities of cloud storage and management.
Source: Bleeping Computer — 2026-08-31