File server permission audit: the spreadsheet that ends "who can see this folder?"

File permissions sprawl the way shared drives sprawl: one folder at a time, one "quick, can you give her access" at a time, until the day a departure triggers the question nobody can answer — what exactly could they see? The user access review covers accounts and apps; this page is the pass for the folders themselves: the NAS share, the SharePoint site, the Google Drive, and the "old-server" share somebody forgot to decommission. One afternoon for the first audit, thirty minutes per quarter after that.

1. Inventory the shares — from the console, not from memory (60 minutes)

Ground truth is the admin console, not anyone's memory. NAS admin panel for SMB shares, SharePoint admin center for sites, Google Drive's shared-drive list, plus every cloud-sync root on the accounting laptop. List each shared root with what it holds and which business function it serves. The share nobody can name a purpose for is the first finding.
Include the forgotten servers. Every small office has a share that survived a migration: the old server still powered on "just in case", the external drive plugged into the router. The server decommissioning checklist is the exit for those; the audit is how they get found.
One row per share in a spreadsheet: share name, where it lives, business function, owner (a person, not "IT"), access model (group or per-user), external links (yes/no), last reviewed. This sheet — not the folders — is the deliverable; it is what makes the next audit thirty minutes.

2. The two dangerous defaults: Everyone groups and unbroken inheritance

Run the open-share test first. Enumerate folders where "Everyone", "Authenticated Users", or "domain users" has read or write access. In a typical first audit this list is longer than expected, and it contains payroll. The fix is deliberate: a folder is either intentionally open (documented, reviewed) or it inherits nothing from an open parent.
Break inheritance where the data changes class. The finance subfolder inside the general share should not inherit the open share's permissions. Breaking inheritance is a one-click operation; the discipline is writing why in the audit row, so the next person does not "helpfully" re-enable it.
Least privilege is a direction, not a day. You will not get to perfect access in one pass, and pretending to is how audits die. The realistic goal for pass one: no write access for Everyone anywhere, and the sensitive folders named and closed. Read-access sprawl gets tightened over the following quarters.
Cloud shares have the same trap with better manners. Microsoft 365 and Google Drive both default to broad internal sharing — the M365 security checklist and Workspace checklist cover the tenant-level sharing defaults; this audit walks the actual folders underneath them.

3. Group-based access only: no per-person grants

One group per role, and access follows the group. "Accounting" gets the finance share; "Operations" gets the ops share. A permission list you can read as a roster is auditable; a folder with nine individual user entries and one mystery account is not.
Per-user ACLs are findings, not features. Every individual grant on a folder is a TODO: either it becomes a group membership (role-based, reviewable) or it is removed. The exception worth writing down: a named project folder with an expiry date in its own row.
Group membership must mirror the current roster. The group "Accounting" containing three people who left in 2024 is the access review's favorite finding. Membership lists print in one page — diff them against the current org chart and the offboarding checklist that should have caught the exits.

4. External sharing links: the shadow perimeter

Search for "anyone with the link" and treat every hit as a finding. Anonymous links are how small offices leak without knowing it: a link shared to a vendor in March, forwarded twice, still open in December. Enumerate them, kill the stale ones, and keep only links with a reason and an expiry.
Turn anonymous sharing off by default at the tenant level so the exception requires intent. The working pattern for real vendor collaboration is a named external folder, expiring access, and a row in the audit sheet — not a link that outlives the project.
The client-facing folder deserves its own rules. Expiry dates on every link, notification when files are added, and a monthly glance at who actually accessed it. This is also the answer to the "how do you protect client data" question in the customer security questionnaire — a real answer with a real screenshot beats "we are careful".

5. Admins, service accounts, and the backup job with god rights

Full-control access is a short list. The audit sheet names every account with admin or full-control access to the file estate and why it needs it. Service accounts count: the backup job account that reads everything is legitimate; the backup account that can also delete and nobody remembers creating is not.
Backup accounts get read-scoped where possible — ransomware loves a backup credential that can encrypt the backups too. The backup encryption checklist covers the storage side; the permission audit covers who can touch the job.
Break-glass is documented, tested, and rare. The one admin account that exists for emergencies belongs on the break-glass checklist, not scattered across three desktops as a saved browser password.

6. Wire access to joiner-mover-leaver, not hallway conversations

The rule that makes the audit hold: access changes only through a request, never by direct grant. The access request and offboarding checklist is the form; the audit sheet is the map. "Just give her access to the drive" becomes "add her to Operations — here's the request", which leaves a trail.
Role changes are the leak everyone forgets. The promoted employee who kept their old department's folders is a joiner-mover-leaver miss. Access follows the current role; movers lose the old group in the same week they gain the new one.
Departures are the audit's deadline. The offboarding checklist removes the account; the file audit is what answers "could they still see the folders" afterwards — especially shared mailboxes, synced folders, and the personal laptop that synced a share the onboarding checklist provisioned.

7. The quarterly thirty minutes, and the evidence it produces

Export the permission report, diff against last quarter, read the changes. Every file platform can produce a permissions export; the thirty minutes is spent on the delta, not the whole list. New folders, new external links, new per-user grants — each gets a decision, and the shadow IT audit often explains the folders nobody can source.
The export is also evidence. The cyber insurance application asks about access controls; enterprise customers score it in the questionnaire. A dated permission report beats an assertion, and it is the same artifact both times.
One line per change, in the log. Who approved, what changed, why. The audit without a log is a snapshot; the log is what turns it into a control. Feed the trend line into the annual security review and the server hardening pass.

Small-team honesty note: this audit will not make your file server perfectly locked — small teams run on hallway conversations, and some of that looseness is the cost of moving fast. What it buys is a map: one spreadsheet that answers "who can see this folder" in minutes instead of folklore, a quarterly diff that catches drift while it is still one folder instead of a rebuild, and the evidence artifact that insurance and enterprise customers both ask for. One afternoon, then thirty minutes a quarter. That is the whole program.