01
Confirm the correct group
Compare with a known-good user in the same role and verify the group is actually the one granting access to the target resource.
Everyday IT · Groups & Permissions
The group change can be correct and the user can still see Access Denied.
Windows access depends on the group path, the folder ACL, share permissions, and the user's current logon token.Verify the permission design before changing it again.
Use this order
Group membership alone does not prove the user currently has effective access.
02
Confirm the exact resource
Verify the user is testing the intended server, share, folder, or UNC path. Similar drive letters and shortcuts can point to different resources.
03
Check Effective Access
Use the folder's Effective Access view when available to see what Windows calculates for the user instead of reasoning from one ACL entry alone.
04
Refresh the user's logon token
New group membership may not exist in the user's current Windows access token. Have the user sign out and back in, or otherwise refresh the session, before declaring the permission change ineffective.
Remember that SMB and NTFS combine
A correct NTFS entry can still be blocked by the share layer.
Share
Check the network share permission
A restrictive share permission can block access even when the NTFS ACL appears correct.
NTFS
Check inheritance and scope
Verify whether the expected group entry applies to the exact folder and whether child objects have different or unique permissions.
Nested groups
Do not assume membership is simple
Access may come through nested groups. Verify the complete membership path when the direct group list does not explain the result.
Other entries
Deny and service identities matter
An explicit Deny or another restrictive entry can override expected access. Preserve administrator, SYSTEM, service, and backup identities while troubleshooting.
What not to do
Do not redesign the ACL because one user has not refreshed their session.
Do not
Add direct user permissions first
Fix the intended group-based access path rather than creating a one-off permission that increases future sprawl.
Do not
Use broad Deny as a shortcut
Deny entries can override otherwise valid access and make later troubleshooting much harder.
Do not
Break inheritance casually
Before changing inheritance, record the ACL, identify child exceptions, preserve a known-good administrative path, and understand service dependencies.
Escalate
When the permission model is unclear
Pause when the owner cannot confirm who should have access, nested groups are complex, child folders intentionally differ, or a line-of-business workflow depends on the folder.
Users → Groups → Access → Token.
Prove both sides afterward: an approved user can work, and an unapproved user cannot.