Ask the question out loud in a five-person office — "who can see the payroll folder?" — and watch the answers: "just me and..." "...I think the accountant..." "...didn't we fix that last year?" File permissions sprawl one "quick, can you give her access" at a time, and the first time it matters is the day someone leaves.
We turned the cleanup into a checklist you can run in one afternoon, then re-run in thirty minutes a quarter. The short version:
1. Inventory from the console, not from memory. List every shared root — NAS shares, SharePoint sites, Google Drives, and the old server that survived a migration "just in case". A share nobody can name a purpose for is your first finding. The spreadsheet (share, location, business function, owner, access model, external links, last reviewed) is the actual deliverable.
2. Kill the two dangerous defaults. Run the open-share test: every folder where Everyone, Authenticated Users, or domain users has access. Then break inheritance where the data class changes — the finance subfolder should not inherit the open share's permissions — and write down why, or someone will helpfully re-enable it.
3. Groups, not people. One group per role; folder ACLs you can read as a roster. Every per-person grant is a TODO: make it a membership or remove it. And diff the group rosters against the actual org — the "Accounting" group with three people who left in 2023 is the access review's favorite finding.
4. External links are the shadow perimeter. Enumerate every "anyone with the link". Kill the stale ones, turn anonymous sharing off at tenant level so exceptions require intent, and give client-collaboration folders expiry dates and an owner.
5. Admins and the backup job. Full-control access is a short, named list — including service accounts. A backup credential that can also delete backups is ransomware's favorite shape; scope it read-only where you can.
6. Wire access to joiner-mover-leaver. Access changes through a request form, never by hallway conversation. Movers lose the old group the same week they gain the new one. Departures get a post-check: could they still see the folders?
7. Thirty minutes a quarter. Export the permission report, diff it against last quarter, read the changes. New folders, new external links, new per-user grants — each gets a decision and a log line. The dated export doubles as cyber-insurance evidence and the answer enterprise customers score in their security questionnaires.
The full walkthrough — with the realistic small-team honesty notes (least privilege is a direction, not a day) — is live here:
📄 File Server Permission Audit for Small Teams — part of ops-notes, 115+ free checklists and runbooks for small-business IT and ops.
If you want the version with templates, the paid kit is here:
- Automation Starter Pack — $19 — pick-first workflows for small teams
- Ops Starter Kit — $14 and Vol. 2 — $27 — incident response and comms
- Agent Ops 24/7 — $19 — running AI agents on real workloads
- The First 30 Minutes — free
Coupon HIVE-LAUNCH30 takes 30% off anything in the store, no expiry.
The one-line takeaway: an audit you can re-run in thirty minutes is a control; an audit that needs a whole afternoon every time is a one-off. Build the spreadsheet, keep the diff, log the changes — and "who can see this folder" stops being folklore.
Related notes: the user access review checklist pairs with this one, and the offboarding checklist is where the departures half gets enforced.
Top comments (0)