Disks, shares and NTFS permissions on Windows Server

Shut down SRV01 for step 1. You’ll add the disk from your laptop, then do everything else on SRV01 as SAATLAB\Administrator in PowerShell as administrator.

1Add a 20 GB data disk to SRV01

On your laptop, with SRV01 powered off:

VBoxManage storagectl SRV01 --name SATA --portcount 4
VBoxManage createmedium disk --filename C:\Lab\VMs\SRV01\SRV01-data.vdi --size 20480
VBoxManage storageattach SRV01 --storagectl SATA --port 2 --device 0 --type hdd --medium C:\Lab\VMs\SRV01\SRV01-data.vdi
VBoxManage startvm SRV01

On SRV01, bring the new disk online as drive D:

Get-Disk | Where-Object PartitionStyle -eq 'RAW' |
    Initialize-Disk -PartitionStyle GPT -PassThru |
    New-Partition -DriveLetter D -UseMaximumSize |
    Format-Volume -FileSystem NTFS -NewFileSystemLabel Data -Confirm:$false

You should see something like this:

DriveLetter FriendlyName FileSystemType DriveType HealthStatus OperationalStatus SizeRemaining     Size
----------- ------------ -------------- --------- ------------ ----------------- -------------     ----
D           Data         NTFS           Fixed     Healthy      OK                     19.92 GB 19.98 GB

GPT is the modern partition style: it supports disks over 2 TB and many partitions, where the old MBR style doesn’t. ReFS is the other file system you’ll see on servers; it’s built for large volumes and Hyper-V, but file shares still mostly use NTFS.

✅ Checkpoint: Drive D: labelled Data exists on SRV01 with about 20 GB.

2Create the IT groups the AGDLP way

On SRV01 (the AD module is there from Lesson 13):

$g = 'OU=Groups,OU=SAATLAB,DC=saatlab,DC=internal'
New-ADGroup -Name GG_IT -GroupScope Global -GroupCategory Security -Path $g
New-ADGroup -Name DL_ITShare_Modify -GroupScope DomainLocal -GroupCategory Security -Path $g
Add-ADGroupMember GG_IT -Members rahul.verma, sneha.reddy
Add-ADGroupMember DL_ITShare_Modify -Members GG_IT
Get-ADGroupMember DL_FinanceShare_Modify -Recursive | Select-Object -ExpandProperty SamAccountName

You should see something like this:

arjun.rao
meena.iyer
priya.sharma

✅ Checkpoint: GG_IT and DL_ITShare_Modify exist, and the Finance resource group still resolves to the three Finance users.

3Create the folders and set NTFS permissions

On SRV01, run this:

New-Item -ItemType Directory D:\Shares\Finance, D:\Shares\IT | Out-Null
icacls D:\Shares /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "Authenticated Users:RX"
icacls D:\Shares\Finance /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "SAATLAB\DL_FinanceShare_Modify:(OI)(CI)M"
icacls D:\Shares\IT /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "SAATLAB\DL_ITShare_Modify:(OI)(CI)M"
icacls D:\Shares\Finance

You should see something like this:

D:\Shares\Finance NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                  BUILTIN\Administrators:(OI)(CI)(F)
                  SAATLAB\DL_FinanceShare_Modify:(OI)(CI)(M)

Successfully processed 1 files; Failed processing 0 files

Read the codes: F is Full control, M is Modify, RX is Read & execute. (OI)(CI) means the entry flows down to files and subfolders. Authenticated Users:RX on D:\Shares has no flags, so it applies to that folder only: people can open the top level and see what’s in it, nothing more.

/inheritance:r removes inherited entries, so the drive’s default permissions (which let every user create folders) don’t leak in. Each department folder now has exactly three entries.

✅ Checkpoint: icacls shows SYSTEM, Administrators and the department’s DL group on each folder, and nothing inherited.

4Share it, with access-based enumeration

On SRV01, run this:

New-SmbShare -Name Departments -Path D:\Shares -FullAccess 'SAATLAB\Domain Admins' -ChangeAccess 'NT AUTHORITY\Authenticated Users' -FolderEnumerationMode AccessBased
Get-SmbShareAccess -Name Departments | Select-Object AccountName, AccessControlType, AccessRight

You should see something like this:

AccountName                      AccessControlType AccessRight
-----------                      ----------------- -----------
SAATLAB\Domain Admins            Allow             Full
NT AUTHORITY\Authenticated Users Allow             Change

The share lets every signed-in user through the gate with Change; NTFS decides the rest. -FolderEnumerationMode AccessBased turns on ABE, so people only see the folders they can open.

✅ Checkpoint: The Departments share exists with Domain Admins Full and Authenticated Users Change.

5Test as Priya from CL01

Start CL01 and sign in as SAATLAB\priya.sharma. Open a normal PowerShell window.

Run this:

Get-ChildItem \\SRV01\Departments | Select-Object -ExpandProperty Name
'Q3 budget draft' | Set-Content \\SRV01\Departments\Finance\budget.txt
Get-ChildItem \\SRV01\Departments\Finance | Select-Object Name, Length
whoami /groups | Select-String 'Finance'

You should see something like this:

Finance

Name       Length
----       ------
budget.txt     17

SAATLAB\GG_Finance                Group            S-1-5-21-...-1112 Mandatory group, Enabled by default, Enabled group
SAATLAB\DL_FinanceShare_Modify    Alias            S-1-5-21-...-1113 Mandatory group, Enabled by default, Enabled group

Priya sees only Finance; IT is hidden by ABE because she has no access to it. She can write in Finance because her token contains both groups. Domain local groups show as “Alias” in whoami.

✅ Checkpoint: Priya lists only Finance, creates budget.txt, and whoami shows both Finance groups.

6Check effective access on the server

On SRV01, open File Explorer, right-click D:\Shares\IT, choose Properties, Security, Advanced, then the Effective Access tab. Click Select a user, enter priya.sharma, and click View effective access.

Every row shows a red cross: Priya has no access to IT. Do the same for sneha.reddy and you’ll see Modify rights, through GG_IT. This tab answers “why can or can’t this person open it?” without signing in as them.

✅ Checkpoint: Effective Access shows no rights for Priya on IT and Modify for Sneha.

7Give Priya a home folder

On SRV01, create a hidden share for home folders and Priya’s folder:

New-Item -ItemType Directory D:\Home\priya.sharma -Force | Out-Null
icacls D:\Home /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "Authenticated Users:RX"
icacls D:\Home\priya.sharma /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "SAATLAB\priya.sharma:(OI)(CI)F"
New-SmbShare -Name 'Home$' -Path D:\Home -FullAccess 'NT AUTHORITY\Authenticated Users' -FolderEnumerationMode AccessBased
Set-ADUser priya.sharma -HomeDrive 'H:' -HomeDirectory '\\SRV01\Home$\priya.sharma'

The $ at the end of the share name hides it from browsing lists. Sign Priya out of CL01 and back in, open File Explorer, and you’ll see drive H: pointing at her own folder.

When you set the home folder in Active Directory Users and Computers instead, it creates the folder and sets these permissions for you. Roaming profiles, which copy the whole user profile to a share, are an older feature; most companies now use Folder Redirection or OneDrive, covered with Group Policy in Lesson 20.

✅ Checkpoint: Priya has an H: drive after signing in again, and only she (plus admins) can open her folder.

Take snapshots of SRV01 and CL01 called “Shares ready” when you’re done.

'SRV01','CL01' | ForEach-Object { VBoxManage snapshot $_ take "Shares ready" }