Windows Network Share Permissions Audit: How to Find Overly Permissive Shares Before an Attacker Does

Enumerate all file servers in the domain:

# File servers typically have specific services or are in a Servers OU
# Option 1: Enumerate shares from a list of known file servers
$fileServers = @('fileserver01', 'fileserver02', 'nas01')

# Option 2: Find all domain computers with SmbServer role
# (requires admin access to each)
$fileServers = Get-ADComputer -Filter * -Properties OperatingSystem |
    Where-Object { $_.OperatingSystem -like '*Server*' } |
    Select-Object -ExpandProperty Name

Enumerate shares on each server:

# For each file server, get all shares and their permissions
$results = @()
foreach ($server in $fileServers) {
    try {
        $shares = Get-WmiObject -Class Win32_Share -ComputerName $server -ErrorAction Stop |
            Where-Object { $_.Type -eq 0 }  # Type 0 = Disk shares (excludes admin shares and IPC)
        
        foreach ($share in $shares) {
            # Get share-level permissions
            $acl = Get-WmiObject -Class Win32_LogicalShareSecuritySetting `
                -Filter "Name='$($share.Name)'" -ComputerName $server
            $results += [PSCustomObject]@{
                Server    = $server
                ShareName = $share.Name
                Path      = $share.Path
                ShareACL  = $acl | ConvertTo-Json -Compress
            }
        }
    } catch {
        Write-Warning "Failed to query $server: $_"
    }
}
$results | Export-Csv C:\ShareAudit.csv -NoTypeInformation

Simpler approach using Get-SmbShare (if you have admin access and remoting enabled):

$allShares = @()
foreach ($server in $fileServers) {
    $shares = Invoke-Command -ComputerName $server -ScriptBlock {
        Get-SmbShare | ForEach-Object {
            $share = $_
            $access = Get-SmbShareAccess -Name $share.Name
            [PSCustomObject]@{
                Server     = $env:COMPUTERNAME
                Name       = $share.Name
                Path       = $share.Path
                Access     = ($access | ForEach-Object { "$($_.AccountName):$($_.AccessRight)" }) -join '; '
            }
        }
    } -ErrorAction SilentlyContinue
    $allShares += $shares
}
$allShares | Export-Csv C:\ShareAuditFull.csv -NoTypeInformation

After collecting the share data, filter for these high-risk patterns:

1. Everyone: Change or Full Control

# From the share audit CSV:
$shares = Import-Csv C:\ShareAuditFull.csv
$everyoneShares = $shares | Where-Object {
    $_.Access -match 'Everyone' -and
    ($_.Access -match 'Change' -or $_.Access -match 'Full')
}
$everyoneShares | Format-Table Server, Name, Path, Access

2. Authenticated Users: Change or Full Control

$authUserShares = $shares | Where-Object {
    ($_.Access -match 'Authenticated Users' -or $_.Access -match 'Domain Users') -and
    ($_.Access -match 'Change' -or $_.Access -match 'Full')
}

3. Admin shares accessible on workstations (test from a management machine):

# Test if C$ is accessible on workstations
$workstations = Get-ADComputer -SearchBase 'OU=Workstations,DC=domain,DC=com' -Filter * |
    Select-Object -ExpandProperty Name
foreach ($ws in $workstations[0..20]) {  # Test first 20 for speed
    $path = "\\$ws\C$"
    $accessible = Test-Path $path -ErrorAction SilentlyContinue
    Write-Output "$ws C$ accessible: $accessible"
}

4. Shares with no current users or last access older than 1 year (orphaned shares): Check the underlying folder's last modified date:

# For each share, check when the shared folder was last written to
foreach ($share in $allShares) {
    if ($share.Path -and (Test-Path $share.Path)) {
        $lastWrite = (Get-Item $share.Path).LastWriteTime
        if ($lastWrite -lt (Get-Date).AddYears(-1)) {
            Write-Output "ORPHANED: $($share.Server) - $($share.Name) - Last write: $lastWrite"
        }
    }
}

Before remediating, verify the effective permission by checking both layers:

# Get share-level permissions
Get-SmbShareAccess -Name 'SharedFolder'
# Example output:
# AccountName          AccessControlType  AccessRight
# Everyone             Allow              Full

# Get NTFS permissions on the underlying folder
$folderPath = '\\server\c$\SharedFolder'
(Get-Acl -Path $folderPath).Access |
    Select-Object IdentityReference, FileSystemRights, AccessControlType |
    Where-Object { $_.AccessControlType -eq 'Allow' }

Interpretation examples:

The common false positive: A share with Everyone: Full Control but NTFS permissions that restrict access to a specific group. The share permission is technically overly broad but the NTFS permissions are the effective control. The remediation is to tighten the share permission to match the NTFS permission (remove the false sense of security from a 'Full Control' share ACE).

Step 1: Document the intended access before changing anything

# For each share being remediated, document current state
Get-SmbShareAccess -Name 'SharedFolder' | Export-Csv C:\Remediation-Before-SharedFolder.csv
(Get-Acl -Path '\\server\c$\SharedFolder').Access | Export-Csv C:\NTFS-Before-SharedFolder.csv

Step 2: Replace Everyone with Authenticated Users if broad access is needed

# Remove Everyone, add Authenticated Users with Read
Revoke-SmbShareAccess -Name 'SharedFolder' -AccountName 'Everyone' -Force
Grant-SmbShareAccess -Name 'SharedFolder' -AccountName 'Authenticated Users' -AccessRight Read -Force

Step 3: Replace broad groups with specific groups

# Replace Authenticated Users with a specific AD group
Revoke-SmbShareAccess -Name 'SharedFolder' -AccountName 'Authenticated Users' -Force
Grant-SmbShareAccess -Name 'SharedFolder' -AccountName 'DOMAIN\SharedFolder-ReadAccess' -AccessRight Read -Force
Grant-SmbShareAccess -Name 'SharedFolder' -AccountName 'DOMAIN\SharedFolder-WriteAccess' -AccessRight Change -Force

Step 4: Remove orphaned shares

# Remove a share (does not delete the folder, only the share)
Remove-SmbShare -Name 'OldProjectShare' -Force

Communication before remediating: Email the business owners of high-risk shares before changing permissions, not after. Include: what the share is named, what the current permissions are, what you plan to change, and when. This prevents the outage call where you have to roll back at 3 AM.