A systems administrator is troubleshooting an issue where users cannot access a newly created network share named \\SERVER1\FinanceDocs. The administrator has verified the following:
The users are members of the "Finance_Users" security group in Active Directory.
The "Finance_Users" group has been granted "Full Control" NTFS permissions to the FinanceDocs folder on the server.
The server's host firewall has an exception for "File and Printer Sharing".
Users can successfully ping the server by its hostname.
Despite these checks, users receive an "Access is Denied" message. Which of the following is the MOST likely cause of this problem?
An anti-malware application is blocking access to the files.
The DNS A record for SERVER1 is pointing to the wrong IP address.
A rogue service on the server has exhausted all available memory.
The share permissions for FinanceDocs are misconfigured.
The correct answer is that the share permissions are misconfigured. When a resource is accessed over a network, Windows evaluates both the Share permissions and the NTFS permissions. The most restrictive of the two permission sets becomes the user's effective permission. In this scenario, while the NTFS permissions are set to "Full Control," the share permissions are likely set to be more restrictive (e.g., Read-only, or the "Finance_Users" group may not be listed at all), causing the "Access is Denied" error. It is a common administrative practice to set Share permissions to "Full Control" for specific groups and then use the more granular NTFS permissions to control access.
An anti-malware application could potentially lock files, but it is less likely to cause a consistent "Access is Denied" error for an entire security group and would typically generate different errors, such as "file in use."
A rogue service exhausting memory would likely cause server-wide performance degradation or crashes, not a specific and consistent permissions-based error message.
A DNS misconfiguration is unlikely because the scenario states that users can successfully ping the server by its hostname, which confirms that name resolution is working correctly.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
Why must both Share and NTFS permissions be configured for network shares?
Open an interactive chat with Bash
What is the difference between Share permissions and NTFS permissions?
Open an interactive chat with Bash
What steps can be taken to configure Share and NTFS permissions correctly?