Lab 04: File Shares and GPO

Overview

In this lab, I extended the existing corp.nietz.co.uk environment by adding FS1 as a dedicated file and print server, creating department share folders, assigning permissions to the Active Directory groups prepared in Lab 03, and using Group Policy to deliver mapped drives to users.

This builds directly on the earlier domain controller, domain join, and Active Directory user/group administration labs.

Objective

The objective was to create a realistic file share and Group Policy baseline for Nietz Ltd, using department security groups to control access and validating the final user experience from a domain-joined workstation.

Environment

Configuration

1. Prepare FS1 for File Services

I prepared FS1 as a separate domain member server so file and print services were not hosted on the domain controller.

Context: Keeping file and print services on a member server creates a more realistic support environment than hosting every service directly on the domain controller.

2. Department Folder Structure

I created the department folder structure on FS1 for IT, HR, Finance, Sales, and Management.

Context: A clear folder layout makes access control, mapped drives, and support troubleshooting easier to document and validate.

3. NTFS Permissions

I assigned NTFS permissions using the department security groups created in Lab 03.

Context: NTFS permissions provide the real access control. Share permissions expose the folder over the network, but NTFS permissions determine what users can actually access.

4. SMB Shares

I created hidden SMB shares for the department folders so users could access resources through FS1.

Context: SMB shares expose department folders to clients, while NTFS permissions enforce the access model through Active Directory security groups.

5. Drive Mapping GPO

I created a Group Policy object to map department drives based on Active Directory group membership.

Context: Mapped drives are a common helpdesk and MSP support area because users often report missing drives, incorrect mappings, or access denied errors.

6. Shared Printer Object

I staged and shared the PRN-HQ-01 printer object on FS1 for later printer deployment and support validation.

Context: Printer deployment remains a common endpoint support task in small business and MSP environments.

7. Client Policy Application

I confirmed on CL1 that the mapped drive policy was processed from the domain for the signed-in test user.

Context: Policy application must be validated on a client workstation, not only configured in Group Policy Management.

8. Mapped Drive Validation

I validated the end-user mapped drive experience on CL1 and confirmed that the expected department drive appeared for the signed-in HR user.

Context: Helpdesk validation should confirm the user experience, not just the server-side configuration.

9. Access Control Validation

I tested authorised and unauthorised file share access to confirm the permission model worked correctly.

Context: Access validation is the most important proof for a file share lab because folder visibility alone does not prove permissions are correct.

Validation

The lab was validated when FS1 was confirmed as a domain-joined file server, department folders and SMB shares existed, NTFS permissions were assigned to the correct Active Directory groups, mapped drives were delivered by Group Policy, and CL1 showed the expected user access.

Access testing confirmed that the HR test user could open the HR department share and was blocked from the unrelated Finance share.

Key Technical Outcomes

This lab demonstrated how Active Directory groups, NTFS permissions, SMB shares, and Group Policy work together to provide controlled access to shared company resources.

It also showed why file share validation should include both server-side configuration and client-side user testing.