File Share Servers(OBJ.2.3)

A file share server is a dedicated system that stores files and makes them accessible to multiple users across a network. Rather than storing documents locally on individual computers, organizations centralize files on a server where users can access, edit, and collaborate on shared data. This approach simplifies backup procedures, improves collaboration, and allows administrators to manage permissions from a single location.

Common File Sharing Protocols

Different protocols handle file sharing depending on the operating system and network environment.

SMB (Server Message Block)

SMB is the primary file sharing protocol for Windows networks. Modern Windows systems use SMB 3.x (Windows 10/11 and Server 2016 and later negotiate SMB 3.1.1), which adds encryption, integrity checking, and better performance over SMB 2. SMB operates over TCP port 445. When you map a network drive in Windows using a UNC path like \\servername\sharename, you're using SMB.

SMB is also known as CIFS (Common Internet File System), an older dialect of the same protocol; you will still hear the file share service called "SMB/CIFS." A history point worth knowing: legacy SMB relied on NetBIOS over TCP, using UDP ports 137 and 138 and TCP port 139, but modern SMB runs directly on TCP 445 and does not need NetBIOS. On the exam, if you see port 445, think SMB file sharing. SMBv1, the oldest dialect, is now disabled by default in current Windows because it was exploited by ransomware such as WannaCry, so encountering a device that only speaks SMBv1 is both a compatibility and a security problem.

NFS (Network File System)

NFS is the standard file sharing protocol for Linux and Unix systems. It allows remote directories to be mounted as if they were local storage. NFS is commonly used in data centers and environments with many Linux servers. NFSv4 uses TCP port 2049.

Where SMB carries Windows-style user permissions inside the protocol, traditional NFS trusts the client to report the user and group IDs, so security historically depended on controlling which hosts were allowed to mount an export. NFSv4 improved this with stronger authentication options. A mixed environment often runs both: Windows clients reach a share over SMB while Linux servers reach the same data over NFS, which is why cross-platform file servers matter.

AFP (Apple Filing Protocol)

AFP was Apple's native file sharing protocol for macOS. While older Mac systems still support AFP, Apple has transitioned to SMB as the default protocol for file sharing, improving cross-platform compatibility.

FTP/SFTP

FTP (File Transfer Protocol) transfers files between systems but lacks the seamless integration of SMB or NFS. SFTP (SSH File Transfer Protocol) adds encryption for secure transfers. FTP uses ports 20 and 21, while SFTP uses port 22.

Windows File Sharing

Creating a Share

To share a folder in Windows:

1. Right-click the folder and select Properties
2. Navigate to the Sharing tab
3. Click Advanced Sharing
4. Check "Share this folder"
5. Set the share name and configure permissions
6. Click OK to create the share

Share Permissions vs. NTFS Permissions

Windows uses two layers of permissions that work together:

Share Permissions apply only when accessing files over the network. Options include Full Control, Change, and Read. These are simpler but less granular.

NTFS Permissions apply whether accessing files locally or over the network. They offer granular control including Read, Write, Modify, Read & Execute, List Folder Contents, and Full Control.

When both permission types apply, the most restrictive combination wins. For example, if share permissions grant Full Control but NTFS permissions only allow Read, the effective permission is Read.

Best practice: Set share permissions to Full Control for authenticated users, then use NTFS permissions for granular access control. This simplifies troubleshooting by focusing security at one layer.

How the two permission layers actually combine

Getting the combination rule right is a frequent exam and help-desk stumbling point, so it is worth walking through carefully. The evaluation happens in a specific order. First, within a single layer, permissions are cumulative: if a user belongs to a group with Read and another group with Modify, the user's NTFS permission is the sum, Modify. Second, an explicit Deny overrides any Allow in the same layer; a user in a group that is denied access is blocked even if another group grants it. Third, once each layer's effective permission is calculated, the system compares the network share result against the NTFS result and takes the more restrictive of the two.

The key nuance students miss: "most restrictive wins" applies between the two layers, not within them. Consider a user whose group has Change at the share level and whose account has Full Control at NTFS. The effective network permission is Change, because the share layer caps it. Now the same user sitting at the console, logging in locally, is not going through the share at all, so only NTFS applies and they get Full Control. This is exactly why share permissions are often left wide open at Full Control for the group and all real control is done in NTFS: it collapses the puzzle to a single layer and makes effective permissions predictable.

Mapped Drives

Mapped drives assign a drive letter to a network share, making remote folders appear as local drives. Users can map drives manually through File Explorer or administrators can automate mapping through Group Policy or login scripts.

Behind every mapped drive is a UNC path (Universal Naming Convention), written as \\server\share. The mapped letter is just a convenient alias for that path; you can always reach the same location by typing the UNC path directly into File Explorer or the Run box without mapping a letter at all. UNC paths can also point deeper, such as \\server\share\folder\file.docx, and are what login scripts and Group Policy use under the hood.