// SHARED FOLDER PERMISSIONS
How to restrict staff access to folders on a Windows 11 shared drive
You want the payroll and HR folders on your office PC private — visible to you and the right person, and no one else. On a Windows 11 shared drive that’s absolutely doable, but there’s a catch most guides skip: it only works once every member of staff has their own login. Here’s the honest, plain-English version — how to lock folders down, and when a shared PC has quietly outgrown the job. Rated 4.9 on Google.
- ● Family-run since 1995
- ● Business IT specialists
- ● No-fix-no-fee
/01 — THE SHORT ANSWER
The short answer, and the catch
To restrict which staff can open which folders on a Windows 11 shared drive, set NTFS permissions on the folder: right-click it, choose Properties, open the Security tab, click Edit, and grant or remove access for each person. That is the whole mechanism — but there is one catch that trips up almost every small business.
It only works if each member of staff signs in to Windows with their own account. Windows decides who may open a folder based on who is signed in. If the office shares a single login — one ‘Office’ or ‘Reception’ account — there is no way to keep payroll or HR private, because as far as Windows is concerned everyone is the same person. Any folder one of you can open, all of you can.
So the job is really two parts: give people separate logins, then lock the sensitive folders to just the right people. Get the first part wrong and no amount of clicking in the Security tab will help. The rest of this page walks through both, plus the honest point where a shared PC has outgrown the task and a proper business IT setup is the safer answer.
/02 — EVERYONE NEEDS THEIR OWN LOGIN
First, everyone needs their own login
This is step zero, and it is non-negotiable. If everyone in the office uses the same Windows login, folder permissions have nothing to work with. You need a separate, password-protected account for every person who uses the PC.
On Windows 11 you add accounts under Settings > Accounts > Other users (sometimes shown as Family & other users). You can use local accounts — just a username and password on that PC — or Microsoft accounts. For a small office PC, local accounts are usually simplest. Give each person a sensible name and their own password, and make day-to-day accounts standard users rather than administrators, so no one can casually undo your permissions.
Separate logins bring a second benefit beyond privacy: you can finally tell who did what — who saved, changed or has a file open. That matters when two people are fighting over the same spreadsheet; see who has a file open on a shared drive. It also makes leavers tidy: disable their account and their access is gone, which we cover in what to do when an employee leaves.
/03 — LOCK THE SENSITIVE FOLDERS
Lock the sensitive folders with permissions
With per-person logins in place, you can lock the folders. Right-click the folder (say Payroll), choose Properties, open the Security tab and click Edit. You’ll see a list of who currently has access and what they can do.
The tidiest approach is to remove the broad entry — usually ‘Users’ or ‘Everyone’ — that gives all staff access, then click Add and put back only the people who should be in. For each person, choose the right level:
- Read & execute / Read — can open and view files but not change them.
- Modify — can open, edit, save and delete files.
- Full Control — as Modify, but can also change the permissions themselves; staff rarely need this.
Grant the least each person needs and no more. If you have more than a handful of staff, create a group (for example ‘Payroll’) and add people to it, so you set the folder’s access once and just manage who is in the group.
A word on Deny: it’s usually better to simply not grant access than to tick Deny. Deny overrides every Allow and is a classic cause of ‘why is this person locked out of everything?’ Reach for it only when you understand the knock-on effects.
/04 — DON’T FORGET THE NETWORK SHARE
Don’t forget the network share
If other computers connect to this folder over the network, there are two separate sets of permissions, and both apply.
- The Security (NTFS) tab — applies whether someone is sitting at the PC or connecting across the network.
- The Sharing tab — click Advanced Sharing > Permissions. These apply only when connecting over the network.
When someone opens the folder across the network, Windows applies whichever of the two is more restrictive. So if the Security tab says Modify but the share says Read, they get Read. The commonest mistake is setting the Security tab carefully but leaving the share out of step with it — often a leftover restrictive share — and then wondering why access isn’t behaving the way you set it.
The practical rule the professionals use: keep the share broad (Change for staff) and do all the fine-grained control on the Security tab. That way there is only one place to think about. If sharing suddenly stops working after a Windows update rather than a permissions change, that’s a different problem — see shared folders not working after the Windows 11 24H2 update.
/05 — THE HONEST LIMITS
The honest limits of a shared PC
Setting NTFS permissions on a shared PC works, but it has a ceiling — and it’s worth knowing where that is before you rely on it for anything genuinely confidential.
First, a locked folder is not always a hidden folder. On a standard Windows 11 PC, staff can often still see the folder’s name in the list — they just get ‘access denied’ if they try to open it. Cleanly hiding folders from people who lack access is really a file-server feature, not something a shared PC does neatly.
Second, a Windows 11 workgroup is peer-to-peer: every PC manages its own accounts and permissions. If the files live on one PC and three colleagues connect from three others, you have to create matching accounts and juggle permissions on every machine. For two or three people that’s manageable; past that it becomes fiddly, and a single wrong tick can quietly expose payroll or HR data.
When you genuinely need per-person private areas done properly, the right answer is usually a dedicated file server or moving your files into Microsoft 365 and SharePoint, where permissions are per-person and managed in one place rather than PC by PC.
/06 — WHEN TO CALL US
When to call us — and how we fix it
If your business keeps payroll, HR or client-confidential files on a shared Windows 11 PC and you are not completely sure who can see what, this is worth getting right rather than guessing. A wrong Deny can lock the wrong person out of everything; a forgotten broad permission can leave a sensitive folder wide open. Neither is obvious until it bites.
When you call us, we’ll set up a login for each member of staff, structure your folders by who needs them, apply the permissions, and then test each account so you can watch it working — the right people in, everyone else out. If your setup has quietly outgrown a shared PC, we’ll tell you honestly and help you move to a server or Microsoft 365 rather than paper over it.
We’re a family-run team near Bournemouth, working since 1995. Most of this we can do remotely across the UK, usually the same day, and we can visit if you’re in Bournemouth, Poole, Christchurch or wider Dorset. It’s no-fix-no-fee, and ongoing business IT support starts at £24.38/mo per computer. Call 01202 775566 and we’ll get your folders properly locked down.
FAMILY-RUN SINCE 1995 · ★ 4.9 ON GOOGLE · 200+ COMPUTERS UNDER OUR CARE · NO FIX, NO FEE · SAME-DAY REMOTE SUPPORT
// GOOD QUESTIONS
Frequently asked
Do I need Windows 11 Pro to restrict folder access?
No. The Security tab and NTFS permissions work on both Windows 11 Home and Pro. Pro adds tools like BitLocker and Group Policy that help in bigger setups, but for locking a folder to certain staff, Home is enough. What you genuinely need is a separate, password-protected login for each person — without that, no edition can keep a folder private.
We all share one login — why can’t I make a folder private?
Because Windows decides access by who is signed in. If everyone uses the same account, Windows sees one person, so any folder one of you can open, all of you can. The fix is a separate password-protected account per member of staff. Once people have their own logins, folder permissions finally have something to work with, and you can lock payroll or HR to the right people.
Should I use ‘Deny’ to block someone?
Usually no. It’s tidier to simply not give access — remove the broad ‘Users’ entry and add only the people who should be in. A Deny overrides every Allow, so it’s a common cause of ‘why is this person locked out of everything?’ Reach for Deny only when you understand the knock-on effects, and prefer well-chosen Allow permissions the rest of the time.
Will staff still see the folder even if they can’t open it?
Often, yes. On a standard Windows 11 shared PC, a locked folder’s name can still appear in the list — staff just get ‘access denied’ if they try to open it. Cleanly hiding folders from people who lack access is really a file-server feature (called access-based enumeration), which is one reason growing teams move to a proper server or SharePoint.
Can you just set this up for us?
Yes, gladly. We’ll create a login for each member of staff, organise your folders by who needs them, apply the permissions and test every account so you can watch it work. Most of it we do remotely, usually the same day, and we can visit across Bournemouth, Poole, Christchurch and Dorset. See our small-business IT support, or call 01202 775566.
Is a shared Windows 11 PC secure enough for payroll and HR?
For two or three people, carefully set permissions can be fine. Beyond that it gets fragile — each PC manages its own accounts and one wrong tick can expose data. If confidential files really matter to your business, a proper file server or Microsoft 365 with per-person permissions is safer and far easier to manage. We’ll give you a straight answer for your particular setup.
What happens to a folder’s permissions when a member of staff leaves?
You disable or remove their Windows account, and their access goes with it — another reason per-person logins beat a shared one. It’s worth having a tidy leaver routine so old accounts don’t linger; we cover it in what to do when an employee leaves. If you’ve lost the password to a leaver’s PC, see employee left, don’t know the computer password.
Does this work over the network from other computers?
Yes, but there are two sets of permissions: the Security (NTFS) tab and the share. When someone connects over the network, Windows applies whichever is more restrictive. The usual approach is to keep the share broad and do the fine control on the Security tab, so there is only one place to manage. Set only one and you can get puzzling, inconsistent results.
Payroll and HR folders that only the right people can open
We’ll set up per-person logins, lock the sensitive folders and test every account so you can see it working — remotely across the UK, usually the same day. No-fix-no-fee.
01202 775566 · help@365techies.co.uk · MON–FRI 9AM–5PM