When I was performing an audit, I ran across a Terminal Services user-mode server that, according to the administrator, controls access to a critical directory by share permissions only. Several individuals have Terminal Services access. I was skeptical, but I ran a test on a directory that had open file permissions but restricted share permissions, and accessing the directory failed. Is it true that Terminal Services sessions are restricted by share permissions?

Regardless of how you're logged on, you're restricted by share permissions only if you're accessing the file system through a share. For instance, imagine a file called 1stQuarter.xls in the C:\files\finance folder of server A1. The finance folder is shared as FinanceFiles and the files folder is shared as DeptFiles. If you're logged on interactively or via Terminal Services to A1 and try to access the spreadsheet by typing

C:\files\finance\1stQuarter.xls 

at a command prompt, Windows will enforce only the file's permissions—no share permissions will come into play.

If you're logged on to A1 interactively, via Terminal Services, or through a network connection and you attempt to access \\A1\DeptFiles\finance\1stQuarter.xls, Windows will enforce both the file permissions and the permissions defined on the DeptFiles share. If you try to open \\A1\FinanceFiles\1stQuarter.xls, Windows will enforce the file permissions and the share permissions defined for FinanceFiles.

When Windows enforces both share and file permissions, you get the intersection of the two sets of permissions. For instance, if the file grants Read Data, Read Attributes, Write Data, and Write Attributes, and the share grants Read Data and Delete, you would end up with ReadData permission and no other permissions.

So a Terminal Services user is subject to share permissions when accessing local files on the server only when using the share. If the user accesses the file directly by using its local path, share permissions don't come into play. This is why ACLs on a file are so important—someone could try to access the files directly or through a Web server, and the ACLs would be the only thing controlling access to the file.