Insights · Published 8 November 2026
Shared folders start simple. One folder called Shared, everyone can open it, job done. A few years later there are dozens of folders, nobody remembers who can see what, payroll sits next to the marketing photos, and a former staff member's account still has access to everything.
Messy file shares are not just untidy. They make it easy for the wrong person to see salaries or client records, they help ransomware spread further, and they make it hard to find the right version of a document. Here is how to bring order to them.
Organise by department and purpose
Start with a clear top level that matches how the business is organised: for example Finance, HR, Operations, Sales and a general Company folder for things everyone needs, such as forms and policies. Inside each, keep the structure shallow. Very deep folder trees are hard to navigate and hard to secure.
Agree a simple naming rule for files and folders, such as starting with the year or the client name, and write it down. It saves hours of searching.
Permissions by group, not by person
The most important rule: give access to groups, never to individual people. Create a group for each department or role, for example Finance Staff or HR, and give that group access to its folder. When someone joins finance, add them to the group. When they move or leave, remove them. You change one membership instead of hunting through dozens of folders.
Use the smallest access that does the job. Most people need to read and change files, not to change permissions or take ownership. Read only is enough for many shared reference folders.
Remove "Everyone: Full control"
Many file shares are set up with "Everyone" given full control, because it makes problems go away during setup. It also means any account, including a compromised one, can read, change, delete or encrypt every file. If ransomware runs on one laptop, full control everywhere means it can damage everything.
Ask your IT provider to replace these broad permissions with specific groups. Do it carefully and test with the people who use each folder, because removing access in the middle of month-end will not make you popular.
Sensitive folders need extra care
Payroll, HR files, contracts, board papers and student or patient records should be restricted to the few people who need them. Check these first. It is common to find a payroll spreadsheet in a folder the whole office can open, simply because someone saved it in the wrong place.
Leavers and movers
When someone leaves, disable their account on their last day and remove them from all groups. Before you delete anything, check whether they kept important files in their personal folder or on their desktop, and move those into the right department folder.
When someone changes role, remove the old access as well as adding the new. People who have moved around the business often collect access to everything over the years.
Previous versions and shadow copies
Windows Server can take regular snapshots of shared folders, called shadow copies. Staff can then right-click a file or folder, choose Previous Versions and get back an earlier copy without calling IT. This is excellent for accidental deletions and overwritten files.
Shadow copies are not a backup. They live on the same server, so if the disk fails or ransomware deletes them, they are gone. Keep proper backups as well.
Quotas and clean-up
Shared drives fill up with videos, phone backups and duplicate copies. When the disk is full, saving fails and backups can stop. Set sensible storage quotas or at least alerts when space runs low, and do a clean-up once a year. Archive old project folders to read-only storage rather than leaving them in the live share.
Also look for old shares nobody uses: folders left over from a previous server, a scanner share from years ago, or a share on someone's desktop computer. Each one is a forgotten door. Close them.
Audit who has access
At least once a year, ask for a simple report: each main folder, which groups have access, and who is in each group. Go through it with the department heads. They know who should see their files far better than IT does.
Your checklist
Pick two or three of these to start.
- Agree a top-level folder structure by department
- Create groups for each department and assign access to groups only
- Find and remove "Everyone: Full control" permissions
- Restrict payroll, HR and client records to the few who need them
- Disable leavers on their last day and remove all group memberships
- Turn on shadow copies, and confirm proper backups are also running
- Set disk space alerts and close old, unused shares
- Review access with department heads once a year
Dalysie Ghana can review your shared folders, tidy up permissions without disrupting your team, and set up previous versions and backups.