---
title: "Audit Every SMB Share Permission with Get-SmbShareAccess"
description: "Audit SMB share permissions with Get-SmbShareAccess, flag Everyone and Full Control grants, and check the NTFS ACL before you revoke anything."
canonical: "https://adamtheautomator.com/audit-smb-share-permissions-powershell/"
---

# Audit Every SMB Share Permission with Get-SmbShareAccess

> Audit SMB share permissions with Get-SmbShareAccess, flag Everyone and Full Control grants, and check the NTFS ACL before you revoke anything.

Source: https://adamtheautomator.com/audit-smb-share-permissions-powershell/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Audit Every SMB Share Permission with Get-SmbShareAccess](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81d9a96fd378dc47c60a/121705eb357e56699bca0c73e19055d636ddcfdd7418053591d9dbf69af050e2.jpg)

# Audit Every SMB Share Permission with Get-SmbShareAccess

[![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)23 October 20263 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[PowerShell](/tag/powershell/)[Windows](/tag/windows/)[Security](/tag/security/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [Why Everyone Full Control Gets Flagged](#why-everyone-full-control-gets-flagged)
*   [Flag Risky Grants with Get-SmbShareAccess](#flag-risky-grants-with-get-smbshareaccess)
*   [What Each Stage Does](#what-each-stage-does)
*   [Audit More Than One Server](#audit-more-than-one-server)
*   [Triage the Hits Before Revoking Access](#triage-the-hits-before-revoking-access)
*   [Remove the Grants You Cannot Defend](#remove-the-grants-you-cannot-defend)

If the NTFS permissions behind a share are locked down, why does every auditor still circle the line that says Everyone, Full Control?

And if they aren’t locked down, which share has nobody checked since the file server was built, and would one `Get-SmbShare | Get-SmbShareAccess` pipeline catch it?

## Prerequisites

To answer both questions on your own file server, you need:

| Requirement | Details |
| --- | --- |
| Account | Can query shares on the file server, such as a local administrator |
| PowerShell | Runs on that server. Microsoft documents the [SmbShare cmdlets](https://learn.microsoft.com/en-us/powershell/module/smbshare/?view=windowsserver2025-ps) for Windows Server 2016 through 2025, and PowerShell loads the module on first use. |

## Why Everyone Full Control Gets Flagged

Every network request to a share passes two permission checks. The share ACL (the access list stored on the share) applies only to network connections. The NTFS ACL on the folder applies to every access path.

Microsoft’s guide to [managing permissions for shared folders](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753731\(v=ws.10\)) says: “NTFS permissions and share permissions are independent in the sense that neither changes the other, and the most restrictive of the two will be applied to the shared resource.”

The diagram below shows one request passing both checks.

![Share and NTFS checks](https://adamtheautomator.com/wp-content/uploads/publisher/4adb7776456101cb91dfba070f146cff82875bb3897a28f3724204d6278207cc.jpg)

Microsoft’s shared-folder guide also recommends the grant you’re hunting: “If you want to manage folder and volume access by using NTFS permissions exclusively, set share permissions to Full Control for Everyone.”

Even a deliberate Everyone grant deserves scrutiny, because the NTFS ACL becomes the only protection; one accidental loosening exposes the folder.

Everyone also covers less than the name suggests. Microsoft’s [special identity groups reference](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-special-identities-groups) states: “Beginning in Windows Server 2003, the Everyone group contains only Authenticated Users and Guest.” Every signed-in account still qualifies, so each share’s NTFS ACL decides who gets in.

## Flag Risky Grants with Get-SmbShareAccess

Run this on the file server. It lists user-created shares, reads each access list, and keeps any allow entry that matches either test:

```powershell
Get-SmbShare -Special $false |
    Get-SmbShareAccess |
    Where-Object {
        $_.AccessControlType -eq 'Allow' -and
        ($_.AccountName -eq 'Everyone' -or $_.AccessRight -eq 'Full')
    } |
    Select-Object Name, AccountName, AccessRight
```

Each hit prints as one row, as the screenshot below shows.

![Audit pipeline output](https://adamtheautomator.com/wp-content/uploads/publisher/249f0696115fa8b6d5731894afaf4bc3ade6cd80b7da02df319b9afcf16b539c.jpg)

### What Each Stage Does

| Stage | What It Does |
| --- | --- |
| `Get-SmbShare -Special $false` | Drops admin and default shares. Microsoft’s [\-Special parameter description](https://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbshare?view=windowsserver2025-ps) names “Admin share, default shares, IPC$ share” as special, so C$, ADMIN$ and IPC$ stay out. |
| [`Get-SmbShareAccess`](https://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbshareaccess?view=windowsserver2025-ps) | “Retrieves the ACL of the SMB share.” Its `-InputObject` parameter accepts the share objects from the pipeline, so each share flows in without a loop. |
| `Where-Object` | Keeps `Allow` entries only, because a Deny entry for Everyone would otherwise print as a grant. Then keeps Everyone, or any account with the `Full` right. |
| `Select-Object` | Trims the output to three columns. |

`CONTOSO\Finance Admins` shows up too, because the filter flags every `Full` grant, your own admin groups included.

* * *

_**Warning: AccountName is a localized display name. On a non-English Windows install, Everyone prints under another name, and the filter returns an empty table. Run Get-SmbShareAccess once unfiltered to see how your server prints it.**_

* * *

### Audit More Than One Server

Open one session per server with [New-CimSession](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/new-cimsession?view=powershell-5.1) and pass it to `Get-SmbShare` and `Get-SmbShareAccess`, since both accept `-CimSession`. Each call then targets the server that owns the share:

```powershell
$flag = {
    $_.AccessControlType -eq 'Allow' -and
    ($_.AccountName -eq 'Everyone' -or $_.AccessRight -eq 'Full')
}
foreach ($computer in 'FS01', 'FS02') {
    $session = New-CimSession -ComputerName $computer
    Get-SmbShare -Special $false -CimSession $session |
        Get-SmbShareAccess -CimSession $session |
        Where-Object -FilterScript $flag |
        Select-Object PSComputerName, Name, AccountName, AccessRight
    Remove-CimSession $session
}
```

`New-CimSession` connects over WinRM ([port 5985 by default](https://adamtheautomator.com/winrm-port/)), so a server without a listener errors out instead of reporting clean.

## Triage the Hits Before Revoking Access

Resist the urge to revoke on sight. The script reads only the share ACL, so each row needs a read of the NTFS ACL behind it:

| Script shows | Meaning | Next check |
| --- | --- | --- |
| Everyone, Full | Share ACL fully open | Read the NTFS ACL |
| Everyone, Read or Change | Wide audience, capped rights | Confirm the audience |
| Named group, Full | Narrow audience, broad right | Confirm membership |
| Nothing for an expected share | Clean, or a filter gap | Recheck the warning above |

One gap remains in the audit filter: an Authenticated Users grant with `Change` or `Read` matches neither test, so it never prints. Run `Get-SmbShareAccess` unfiltered on any share whose audience you doubt. To [read the NTFS side](https://adamtheautomator.com/ntfs-permissions/), pass the share’s folder path to `Get-Acl`:

```powershell
(Get-Acl -Path (Get-SmbShare -Name Public).Path).Access |
    Select-Object IdentityReference, FileSystemRights, AccessControlType
```

[Get-Acl](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-5.1) returns the security descriptor for a file, folder, or registry key. If the NTFS ACL lists named groups, Everyone at the share is then exactly the setup Microsoft recommends. If it lists Everyone or Users with `Modify` or `FullControl`, you’ve found real exposure.

## Remove the Grants You Cannot Defend

For shares where both ACLs are open, first grant the real audience a named group with [Grant-SmbShareAccess](https://learn.microsoft.com/en-us/powershell/module/smbshare/grant-smbshareaccess?view=windowsserver2025-ps):

```powershell
Grant-SmbShareAccess -Name 'Public' -AccountName 'CONTOSO\Public Users' -AccessRight Change
```

Then rehearse the removal. [Revoke-SmbShareAccess](https://learn.microsoft.com/en-us/powershell/module/smbshare/revoke-smbshareaccess?view=windowsserver2025-ps) supports `-WhatIf`:

```powershell
Revoke-SmbShareAccess -Name 'Public' -AccountName 'Everyone' -WhatIf
```

* * *

_**Warning: Revoke-SmbShareAccess removes all allow entries for that account, and new connections that relied on Everyone lose access when you confirm.**_

* * *

Once the preview looks right:

1.  Drop `-WhatIf` from the command and run it.
    
2.  Confirm the prompt.
    
3.  Rerun the audit. The Public row should drop out of the results. The Finance Admins row stays put.
    

Keep a list of the Everyone grants you chose to leave, so the next audit starts from recorded decisions.

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Faudit-smb-share-permissions-powershell%2F&text=Audit%20Every%20SMB%20Share%20Permission%20with%20Get-SmbShareAccess)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Faudit-smb-share-permissions-powershell%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Faudit-smb-share-permissions-powershell%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b817aab5dca59f1ca0e14/38378bffb6e067df12a1bd90a3921833213a6e328f7d3baabd1fae698d38ddfd.jpg)

### [Fix Kerberos Clock Skew Logon Failures Using w32tm](/fix-kerberos-clock-skew-w32tm/)

Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients.

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81798ecbd4ce17ad4211/3af27311d4ef00790ee9d17c229fa6097b6ee8b242b0a21e0b024c9807f61639.jpg)

### [Who Really Restarted Windows Server? Event ID 1074 and 6008](/event-id-1074-windows-server-restart/)

Use one Get-WinEvent filter to find which account, process, and reason restarted a Windows Server, from Event ID 1074 and 6008 logs.

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b8185a49bd1349023dba2/6163dc370e63610afdd7af994bd2a13ae5a715944748901293297069e411bff0.jpg)

### [Fix Access Denied: Take Ownership with takeown and icacls](/takeown-icacls-take-ownership-folder/)

Fix access denied on a locked Windows folder with takeown and icacls. Make Administrators the owner, grant Full Control, and clear any deny entries.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)