I created a local user intended for a service account on a Windows Server 2019 machine. While reviewing a folder's permissions, I found many former employees listed individually and removed them. After the permission changes were applied, users who previously accessed the files through the service account could no longer see or open them. The users still appear to be individually associated with the service account in directory management, so I'm unsure whether I removed the wrong access entry, changed inheritance, or overlooked another permission layer. What should I check to restore access safely?
3 Answers
Check both layers of access: the share permissions and the NTFS permissions on the Security tab. The most restrictive combination wins, so restoring access in only one place may not be enough. If access was recently restored through group membership, affected users may also need to sign out and back in to receive a refreshed access token.
The terminology may be causing some confusion: a service account is normally a user account, not a container for other users. If this is actually a security group in directory services, make sure that group itself is still assigned to the folder’s ACL. After that, clean up former employees from the group separately instead of assigning individual users directly to the folder.
Start by checking the folder’s Advanced Security Settings and confirm that the service account—or the security group it should use—still has an Allow entry. Also verify whether inheritance is enabled and whether permissions were accidentally replaced on child folders. Use Effective Access for the service account to see what Windows is actually granting or denying.
Thanks for the detailed checklist. I’ll go through the advanced permissions and effective access settings when I’m back at work.