File Server Share Permission Denied for All Users – Quick Fix

When This Error Hits

You're in the middle of your day, maybe someone's moving files around, and suddenly everyone in the office starts yelling. Nobody can open a shared folder on the file server. Not even the admin. You check the share permissions, and they look right. But Windows still throws a "You do not have permission to access \\server\share" error. The error code is usually 0x80070005 or just "Access Denied."

Had a client last month – a small law firm – whose entire document share went dark. Everyone from the paralegal to the managing partner got kicked out. The trigger? An admin had accidentally changed the share permissions while trying to add a new folder. But it can also happen after a Windows Update that messes with the security descriptor.

Root Cause

The real culprit is almost always a corrupted share-level permission entry. Windows stores these in the registry under HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares. When you modify share permissions through the GUI, Windows sometimes writes a bad entry – like a malformed security identifier (SID) or an empty permission list. The share still exists, but it has no valid ACEs (Access Control Entries). So the OS defaults to denying everyone.

Another common cause: a Windows update (like KB5005565 from September 2021) that changed how Windows handles inherited permissions on shares. If the underlying NTFS folder permissions are fine but the share-level permissions got nuked, you'll see this exact problem.

The Fix – Step by Step

Don't waste time with SFC or DISM. Those won't touch share permissions. Here's what works:

Step 1: Check the Current Share Permissions

Open PowerShell as admin and run:

Get-SmbShare -Name "YourShareName" | Select-Object -Property Name, ShareState, ShareType

If it shows ShareState as "Online" but you still can't access it, move to Step 2.

Step 2: Remove and Recreate the Share

This sounds drastic, but it's the fastest fix. The GUI often fails to clear corrupted entries, so do it via PowerShell:

1. Remove the share: Remove-SmbShare -Name "YourShareName" -Force
2. Create it fresh: New-SmbShare -Name "YourShareName" -Path "D:\YourFolder" -FullAccess "Domain Users"

I recommend using "Domain Users" as a starting group, then tighten it later. If you want to keep existing NTFS permissions, add the -ChangeAccess and -ReadAccess flags as needed.

Step 3: Verify NTFS Permissions Are Correct

Share permissions alone don't matter if NTFS blocks. Open the folder properties, go to Security tab, and confirm that "Domain Users" (or your intended group) has at least Read & Execute. If you see "Access Denied" even after Step 2, it's likely an NTFS issue. Fix that with icacls D:\YourFolder /grant "Domain Users":(OI)(CI)R.

Step 4: Reboot the Server

Yes, it's cliché, but after changing share permissions, the LanmanServer service can hold onto stale data. A reboot clears that. If you can't reboot, restart the service: Restart-Service LanmanServer -Force.

Still Failing? Check These

• Check if the share is hidden: If the share name ends with a $, it won't show in browse lists. Clients must type the full path. Remove the $ if you want it visible.
• Check the registry directly: Navigate to HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares and find your share name. The value data should contain Security=.... If it's malformed or empty, delete that registry key manually, then recreate the share via PowerShell.
• Check for conflicting Group Policy: Some GPOs can override share permissions. Run gpresult /h gpresult.html and look for any policies that affect "Network access: Do not allow anonymous enumeration of SAM accounts and shares." Set it to Disabled if it's causing issues.
• Check Windows Update history: If this started after a recent update, uninstall it temporarily. Had a client where KB5008212 from December 2021 broke share enumeration for everyone. Rolled it back, and the share worked immediately.

If none of this works, look at the folder's effective permissions. Run icacls D:\YourFolder and check that the group you're giving access to actually shows up. If not, it's an NTFS inheritance issue – reapply permissions from the parent folder.

One last thing: don't forget to check the firewall. If the clients can't even see the server, maybe the File and Printer Sharing rule got disabled. But that's rare – usually the share is visible but denies access.