DRAG DROP
Your network contains an Active Directory domain named contoso.com. The domain
contains a member server named Server1. Server1 runs Windows Server 2012 R2 and has
the File and Storage Services server role installed.
On Server1, you create a share named Documents. The Share permission for the
Documents share is configured as shown in the following table.
The NTFS permission for the Documents share is configured as shown in the following table.
You need to configure the Share and NTFS permissions for the Documents share.
The permissions must meet the following requirements:
Ensure that the members of a group named Group1 can read files and run programs in
Documents.
Ensure that the members of Group1 can modify the permissions on only their own files in
Documents.
Ensure that the members of Group1 can create folders and files in Documents.
Minimize the number of permissions assigned to users and groups.
How should you configure the permissions?
To answer, drag the appropriate permission to the correct location. Each permission may be
used once, more than once, or not at all. You may need to drag the split bar between panes
or scroll to view content.
Answer: 
Explanation:
Granting a user Full Control NTFS permission on a folder enables that user to take
ownership of the folder unless the user is restricted in some other way. Be cautious in
granting Full Control.
If you want to manage folder access by using NTFS permissions exclusively, set share
permissions to Full Control for the Everyone group.NTFS permissions affect access both locally and remotely. NTFS permissions apply
regardless of protocol. Share permissions, by contrast, apply only to network shares. Share
permissions do not restrict access to any local user, or to any terminal server user, of the
computer on which you have set share permissions. Thus, share permissions do not provide
privacy between users on a computer used by several users, nor on a terminal server
accessed by several users.\
References:
http://technet.microsoft.com/en-us/library/cc754178.aspx
What will happen if we put “allow Group1 Change” share permission? Does it limit NTFS permissions?
0
0
If you limit the share permission to change for Group1, then they will not be able to modify the NTFS permissions of the files that they own.
0
0
tnx
0
0
Could you use NTFS Creator Owner Modify instead of Creator Owner Full Control? Modify would allow them to modify permissions on their own files and would further minimize giving them too many permissions as the question asks.
0
0
Exactly my thought as well.
0
0
No,
Modify = Delete and rename.
Full Control = Permissions and take ownership.
Write = Create and change Files.
0
0
BASED ON THE TABLES the most restrictive limitation is FULL CONTROL…so you share that to the group in the first block and you make sure the creator has that in the 2nd for the NTFS permission.
0
0
If Share has Full Control and NTFS has Creator Modify, that should work. The least restrictive will apply, in which case the user has Modify permission on their OWN files. You don’t over permission them and it fits the question requirements perfectly.
I don’t understand why that’s not the answer though, haven’t seen a valid enough explanation yet.
0
0
I checked in the lab and found out that creator owner permission “MODIFY” is sufficient to change permissions.
Also I found that the “CHANGE” permission for the share is not – it must be Full Control.
0
0
It isn’t enough. NTFS Modify permission allows you to do everything that Full Control does, apart from Change Permissions/Take Ownership.
0
0