claudetools/clients/dataforth/docs/projects/shares-permissions/acl-audit-detail-2026-06-10.md

Dataforth — Shares ACL Audit Detail (INTERNAL — do not send to client)

Captured: 2026-06-10, read-only RMM (Get-SmbShare/Get-SmbShareAccess/Get-Acl as SYSTEM on each server). No changes made. Use: technical baseline for Phase 3 (rollback reference). The client-facing summary is current-state-2026-06-10.md.

Headline

• All eight business shares grant access to all staff via Everyone / Domain Users.
• Domain Users has FullControl (NTFS) on archive, sales, Engineering, sage; Modify on c-drive, e-drive, webshare; ReadAndExecute on ITSvc.
• No custom AD security groups exist (only Domain Users, admin accounts sysadmin/Admin_3652, and service accounts appear).

Share-level + NTFS root ACLs

Share	Server	Path	Share ACL	NTFS root (non-builtin)	Inheritance
c-drive	AD2	C:\Shares\c-drive	Everyone:Full; Domain Users:Change; Admins:Full	Domain Users:Modify	enabled (inherited Users:R+Append+Create)
e-drive	AD2	C:\Shares\e-drive	Everyone:Full; Domain Users:Change; Admins:Full	Domain Users:Modify; sysadmin:Full	protected
webshare	AD2	C:\Shares\webshare	Everyone:Full; Domain Users:Change; Admins:Full	Domain Users:Modify; sysadmin:Full; svc_testdatadb:Full	protected
test	AD2	C:\Shares\test	Everyone:Full; Domain Users:Change; Admins:Full	Everyone:Full; Domain Users:Modify; Guest:Read; sysadmin:Full	protected — DOS/SMB1, leave as-is
sage	SAGE-SQL	C:\sage	Everyone:Full; Admins:Full	Domain Users:FullControl; Admin_3652:Full	protected
sales	FILES-D1	E:\Shares\sales	Everyone:Full; Admins:Full	Domain Users:FullControl; sysadmin:Full (owner)	protected
archive	FILES-D1	E:\Shares\archive	Everyone:Full; Admins:Full	Domain Users:FullControl; sysadmin:Full (owner)	protected
Engineering	AD1	C:\Engineering	Everyone:Full; Admins:Full	Domain Users:FullControl; Admin_3652:Full	protected
ITSvc	AD1	C:\Shares\ITSvc	Everyone:Full; Admins:Full	Domain Users:ReadAndExecute; Domain Computers:ReadAndExecute; Admin_3652:Full	protected

All shares also carry inherited/explicit NT AUTHORITY\SYSTEM:FullControl and BUILTIN\Administrators:FullControl (keep these).

Special / infra shares (exclude from department model)

• test (AD2) — DOS test stations need SMB1 + Guest; keep open.
• webshare (AD2) — preserve svc_testdatadb:Full; restrict humans only.
• ITSvc (AD1) — IT depot; Domain Computers needs Read for deployment.
• NETLOGON / SYSVOL — system shares; never touch.

Phase 3 rollback prep (to do before any change)

• icacls "<path>" /save acl-backup-<share>.txt /t (or Get-Acl export) for each share → store in this folder before modifying.