jperezduerto.info
Security in depth · Unit 22 · Lesson 41 of 44
A network share adds another access check
Compare local and SMB access to the same file using supplied effective permissions.
Helpful before thisWindows privilege escalation
After this lesson you can
- Explain why a successful local write does not establish permission to write through a share.
Follow the access path
An access path is how a user reaches a resource. For an ordinary Windows SMB share backed by NTFS, both the share permission and the file permission must permit a requested network operation. Their grants are not added together. A permissive layer cannot cancel a restriction in the other.
Direct local filesystem access does not pass through that SMB share check. The same file can therefore produce different results through different paths without contradictory permission records.
One file, two routes
The fictional TeamShare exposes an archived report. The supplied effective decisions for Mira are:
| Layer | Allowed ordinary content operations |
|---|---|
| TeamShare | Read |
| Report’s NTFS permissions | Read and write |
Assume the same identity, current group membership, fresh handles, and no privileged override, alternative credentials, or other blocking policy. Network authentication and basic connectivity already succeed. This packet concerns reading and writing existing file content, not deletion or replacement through directory permissions.
Explain both observations
A read through TeamShare passes both layers. A write through it fails the share limit. A direct local write passes the supplied file check because this path does not use TeamShare. Local success is therefore insufficient evidence for accepting the remote workflow.
The owner should first confirm which paths and operations the role actually needs, then review the relevant layer. Avoid broadening the file ACL when it already permits the requested write. Record the path with each acceptance result. Azure Files uses its own identity and share-level authorization configuration; its documentation illustrates the layered principle, not identical administration for every Windows share.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Mira can read/write a file locally, but TeamShare grants her only read. A network write is denied. What follows?
Show the answer
Correct answer: The results are consistent: the SMB path also needs share permission, while the local path does not use that share check. Both applicable layers must permit the network operation; a local result covers a different path.
Try it
- WriteWrite a two-row access table for Mira: local file access and access through TeamShare. Include read/write results, applicable checks, and the evidence required before changing either grant.