// OFFICE FILE SHARING
Shared folder read-only in Windows 11: staff can open files but cannot save
Everyone can see the folder. Everyone can open the files. But the moment anyone presses Save, Windows says the file is read-only or that they do not have permission to save in this location. Nine times out of ten this is not a broken network. It is a mismatch between the two separate permission layers Windows puts on every share, and once you know where to look it is usually a few minutes' work. Rated 4.9 on Google.
- ● No fix, no fee
- ● Rated 4.9 on Google
- ● Trading since 1995
/01 — TWO PERMISSION LAYERS
Why a folder can look perfectly shared and still refuse to save
A shared folder in Windows has two separate permission layers, and almost every read-only share has them set to different things.
The first is the share permission. It lives on the share itself and only applies to people arriving over the network. It has three settings: Read, Change and Full Control. Shared through the Advanced Sharing box, the starting point is usually Read for Everyone — exactly the setting that lets staff open a file and then refuses the save.
The second is the file-system permission on the folder and the files inside it, found on the Security tab. This layer also applies to someone sitting at the machine itself, and it is far more detailed: Read, Write, Modify, Full control and so on.
Windows decides what you may do by comparing the two and applying whichever is more restrictive. Full control on the Security tab counts for nothing if the share above it says Read. That is the whole trick, and it explains the maddening symptom: the folder looks perfectly shared, the Security tab looks generous, and the save still fails.
It also gives you a useful clue. If the file saves fine for someone sitting at the computer hosting it, but for nobody else, look at the share layer first — it is the only layer a local user never goes through.
/02 — CHECK BOTH LAYERS
How to check the share layer and the security layer
Both layers are checked on the computer that hosts the folder — the server, or whichever PC the drive is in — not on the machine that cannot save, and you will need an administrator sign-in there.
Right-click the shared folder, choose Properties, then open the Sharing tab. Click Advanced Sharing and then Permissions. This is the share layer. The person or group who needs to save requires Change, not just Read.
Now move to the Security tab in the same window. This is the file-system layer, and the same person or group needs Modify to create, edit and save. Read & execute alone is enough to open a document and nothing more.
Three things catch people out. A Deny entry usually beats an Allow, and a Deny set directly on the folder always does — so one old Deny against a group someone happens to be in can block them even though every other entry says yes. A subfolder can have inheritance switched off, so it quietly keeps old permissions while the parent gets fixed. And someone newly added to a staff group only picks up the access after signing out and back in, because Windows works from the group list it collected at sign-in.
One exception: if the folder lives on a NAS box or a drive plugged into the router, none of the above applies — those devices keep their own users and their own read or read-write setting in a web admin page, and that is where the change must be made.
/03 — THE FILE IS ALREADY OPEN
When it is not permissions at all: locks and stale lock files
Sometimes the permissions are perfectly fine. The file is simply already open somewhere else, and Windows will not let two people write to the same document at once.
Word and Excel handle that by offering you the file read-only, usually with a message naming whoever has it. Treat the name as a hint rather than a fact — Office reads it out of a small hidden file it left beside the document, and that file is often a leftover from a machine switched off mid-edit rather than a colleague sitting at their desk.
When an Office file is opened, a small hidden companion file appears alongside it with a name beginning ~$. It disappears on a clean close. If the program crashes, a laptop drops off the Wi-Fi, or somebody shuts the lid and goes home, that companion can be left behind and the document stays locked for everyone else long after the person has gone.
On the host computer you can see what is really happening. Open Computer Management, then System Tools, then Shared Folders, then Open Files. It lists every file currently open across the network and the account holding it. A stale lock can be cleared from there — but do it carefully, because closing a file somebody genuinely has open loses whatever they had not yet saved.
/04 — THE FILE ITSELF
The read-only tick, Protected View and Office’s own locks
If one particular file is read-only while everything else in the same folder saves happily, the fault is on the file, not on the share.
The oldest culprit is the read-only attribute. Right-click the file, choose Properties, and look at the tick box on the General tab. Files pick this up when restored from a backup, extracted from a zip, or copied off read-only media, and it travels with the file wherever it goes. Clear the tick and save again. The same tick on a folder behaves differently and tends to reappear on its own — that one is not your problem, so leave it be.
Office then adds locks of its own, and they are easily mistaken for a network fault:
- Protected View — a yellow bar across the top with an Enable Editing button. Common on anything that arrived by email or download, and nothing to do with permissions.
- Marked as Final — somebody set this deliberately; the bar offers Edit Anyway.
- Always Open Read-Only, and Excel’s read-only recommendation — both saved inside the file itself, often years ago by someone who has since left.
Each of these announces itself and gives you an obvious way past. A genuine permission problem does not: it lets you type happily for twenty minutes and only objects when you press Save.
/05 — RESCUE THE WORK
Save a copy now, then fix the cause without wrecking your security
Before anything else, rescue the work in front of you. Do not close the document. In Word or Excel use File then Save a Copy (or Save As), put it in Documents on the local machine, and put the date and your initials in the name. Only then close it. Work that exists only on screen is one stray click away from gone.
Treat that copy as a stopgap rather than a fix. Two people keeping local copies of the same spreadsheet for a week is how a small business ends up with three versions of the price list and no idea which is right. Agree who owns the master, and get the share itself sorted the same day.
You will also find advice online telling you to enable SMB1, switch on insecure guest access, turn off SMB signing, or hand Everyone full control on both layers. Please do not. SMB1 is the ancient version of the file-sharing protocol behind some of the worst ransomware outbreaks of the last decade, and modern Windows no longer installs it. Guest access hands the same rights to anyone who can reach the box, with no account name attached to anything they do — and current versions of Windows block insecure guest logons by default for exactly that reason. Signing is what stops traffic between the PC and the share being tampered with. And Everyone with full control means any compromised device on your network can encrypt or delete the lot, and nothing in the permissions stands between one infected PC and every file you own. Each of these makes the save work by making the business less safe.
FAMILY-RUN SINCE 1995 · ★ 4.9 ON GOOGLE · 200+ COMPUTERS UNDER OUR CARE · NO FIX, NO FEE · SAME-DAY REMOTE SUPPORT
// GOOD QUESTIONS
Frequently asked
Why can I open files on the shared folder but not save them?
Because Windows applies two different permission layers to a network share and gives you whichever is the more restrictive. The share permission (Read, Change or Full Control) sits on the share and only applies over the network. The file-system permission on the Security tab sits on the folder and its files. If the share says Read, you can open anything and save nothing, however generous the Security tab looks. Check the share layer first.
What is the difference between share permissions and security permissions in Windows 11?
Share permissions apply only to people connecting over the network and come in three levels: Read, Change and Full Control. Security permissions are the file-system permissions on the Security tab, they apply to everybody including someone sitting at the machine, and they are much more detailed. Windows combines the two and enforces the stricter result, which is why a folder can be shared correctly and still refuse every save.
How do I find out who has a file open on our network drive?
On the computer that hosts the shared folder, open Computer Management, then System Tools, then Shared Folders, then Open Files. It lists every file currently open over the network and the account holding it. If the name looks wrong, it is often a stale lock left by a crash or a laptop that dropped off the network rather than a person still working. Clearing it is possible, but anything they had not saved is lost, so check with them first.
Word says the document is read-only but the folder is not. What should I do?
That points at the file rather than the share. Check the read-only tick box on the file's Properties, General tab, which files often pick up from backups and zip archives. Then look for an Office message bar: Protected View, Marked as Final and Always Open Read-Only all make a document read-only, and each offers a button to carry on editing. If you need the work now, use Save a Copy into your own Documents folder and sort the original afterwards.
Is it safe to give Everyone full control to fix a read-only shared folder?
No. It makes the save work by removing the protection rather than fixing the fault. Everyone means every account that can sign in anywhere on your network, so anything that gets onto one PC inherits full rights over the whole share, and nothing in the share stops it spreading to every file. Grant the specific staff group Change on the share and Modify on the Security tab instead. That takes the same five minutes, fixes the same problem, and keeps the damage from any one compromised account inside what that group can reach.
Still read-only after all that?
We can look at the share with you remotely, or collect the machine free of charge if it needs hands on it. Call 01202 775566.
01202 775566 · help@365techies.co.uk · MON–FRI 9AM–5PM