How to Block Domain Users from Accessing a Folder

Learn how to restrict access to a sensitive folder on a domain-joined Windows Server using NTFS permissions, security groups, and PowerShell—without accidentally locking out administrators or applications.

What this guide covers

NTFS permissions control who can read, change, or delete files on an NTFS volume. For shared folders, Windows evaluates both share permissions and NTFS permissions; the more restrictive effective result applies over the network. This guide shows a cautious approach for restricting a folder to approved users while preserving administrative and system access.

Prerequisites

• A Windows Server 2025 file server joined to your Active Directory domain.
• An account authorized to change NTFS permissions.
• A test folder and a non-privileged test user.
• The exact domain NetBIOS name and group name.

In the examples below, replace CONTOSO with your domain NetBIOS name and D:\Sensitive with your actual folder path.

Method 1: Restrict access using File Explorer

Method 2: Use PowerShell to inspect permissions

First, record the existing ACL before making changes:

$Path = 'D:\Sensitive'
Get-Acl -LiteralPath $Path | Format-List
(Get-Acl -LiteralPath $Path).Access |
  Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited -AutoSize

For a rollback reference, export the ACL to a file stored in a protected administrative location:

$Path = 'D:\Sensitive'
$Acl = Get-Acl -LiteralPath $Path
$Acl | Export-Clixml -Path 'C:\AdminBackup\Sensitive-folder-acl.xml'

Ensure the backup directory exists and is access-controlled before running the export.

If an explicit Deny is specifically required

Use an explicit Deny only when you have confirmed the group membership and permission inheritance implications. The following example denies read and execute access to the named group on the folder and its child files/subfolders. Run it from an elevated Command Prompt and replace the domain and path:

icacls "D:\Sensitive" /deny "CONTOSO\Domain Users:(OI)(CI)(RX)"

Check share permissions too

If users access the folder through a network share, open Properties → Sharing → Advanced Sharing → Permissions. Review the share ACL as well as the NTFS Security tab. A user needs to be allowed by both layers to perform the requested action; changing NTFS permissions alone may not correct an overly permissive or overly restrictive share configuration.

Verify effective access

1. Sign in on a test client as a standard domain user who should be blocked.
2. Try to open the local path (if applicable) and the UNC path, such as \\FILESERVER\Sensitive.
3. Confirm that an approved group member can still access the folder at the intended permission level.
4. Review Properties → Security → Advanced → Effective Access for the test account.
5. Check application, backup, and scheduled-task access if the folder is used by services.

Troubleshooting

Best practices

• Use least privilege and assign permissions to security groups rather than individual accounts.
• Avoid Deny entries unless there is a clear exception that cannot be modeled cleanly with Allow permissions.
• Do not remove SYSTEM or required administrative permissions without understanding the impact.
• Keep a record of ACL changes and test a rollback procedure.
• Use BitLocker to protect data at rest; NTFS permissions alone do not protect files if an attacker can access the disk offline.

Frequently asked questions

Can I block Domain Users but allow one department?

Yes, but it is usually safer to remove broad access and grant permissions to an approved department security group rather than adding a broad Deny. Carefully verify group nesting and effective access.

Does NTFS Deny override Allow?

Explicit Deny entries generally take precedence over Allow entries during access checks, so they should be used cautiously. Inheritance and explicit entries can make the final result more complex; verify Effective Access.

Will this also block network access?

NTFS permissions apply to local access and are also evaluated for network access. For a shared folder, share permissions are evaluated as well, and the more restrictive effective access applies.

Can I hide the folder instead?

Hiding a folder or using a hidden share does not secure the data. Enforce permissions and test access rather than relying on obscurity.

References and further reading

• Microsoft Learn: Access Control Overview
• Microsoft Learn: Windows file server and SMB overview
• Microsoft Learn: icacls command reference