Your network contains an Active Directory Domain Services (AD DS) domain named adatum.

The course content for Administering Windows Server Hybrid Core Infrastructure explains the effective permission model for SMB shares: “Access to a shared folder is the most restrictive result of the Share permissions and the NTFS permissions. Share permissions control access over the network, while NTFS permissions control access to the file system itself. The effective permission is the intersection—users must have permission in both places.” It also clarifies typical rights: “Read includes viewing and opening; Change/Modify includes creating, changing, and deleting; Full Control adds the ability to change permissions and take ownership.”

Applying this: User1 is in Group1. Share1 grants Group1 = Change, and NTFS on D:\Folder1 grants Group1 = Read. The intersection is Read, so User1 can read files. User3 is in Group3. Share1 grants Group3 = Full Control, but NTFS has no entry for Group3 (and no broader Allow that would include it). Without NTFS Modify/Delete, User3 cannot delete.

Regarding visibility, the share was created with FolderEnumerationMode = Unrestricted. The training states: “With Unrestricted enumeration, the share (and items) are not hidden based on access; users may see the share even if they lack permissions, though access will be denied when opened. Access-Based enumeration hides items from users without permission.” Therefore, when User2 (member of Group2) browses \\Server1, Share1 will be listed, though opening it would rely on permissions.