Data Security: How to Set Up QuickBooks Folder Sharing Permissions

Configuring shared folder permissions for QuickBooks Desktop requires balancing access with security. If permissions are too strict, workstations cannot open company files, resulting in errors like 6000, -107 or H-series lockouts. If permissions are too broad—such as sharing a directory with unauthenticated “Everyone” groups across the network—your financial records, employee social security numbers, and banking details are left exposed to unauthorized users and ransomware.

A secure, functioning QuickBooks share uses a dual-layer permission structure: SMB Network Share Permissions combined with NTFS File System Permissions. Properly configuring these layers grants the QuickBooks Database Service and authorized accounting staff the access they need, while blocking unauthorized network users and protecting your primary company files.

Fast-Fix: The 45-Second Solution

To properly secure and share your QuickBooks folder, set permissions on both the Sharing and Security tabs. In folder Properties > Sharing > Advanced Sharing, grant “Change” and “Read” to Authenticated Users. On the Security tab (NTFS), grant “Full Control” to SYSTEM and your specific QBDataServiceUserXX account, and grant “Modify” to your authorized accounting users. Never give guest accounts or unauthenticated groups access.

---

Quick Status & Triage Snapshot

• Data Risk Tier: High. Misconfigured folder permissions can expose sensitive financial records to unauthorized local users or allow ransomware to encrypt shared database directories.
• Multi-User Impact: System-wide. Missing NTFS permissions will block all network users from opening files, triggering 6000-series errors.
• Common Trigger: Migrating company files to a new server, creating new folders without inherited permissions, or running Windows updates that reset user permissions.
• Estimated Fix Time: 5–10 minutes.

---

The Golden Rule: Share Permissions vs. NTFS Permissions

Windows secures files using two distinct layers. Access is determined by whichever layer is more restrictive:

[Incoming Workstation Connection]
               |
               v
      [1. Network Share Layer]  --> (Controls network access across the UNC path)
               |
               v
      [2. NTFS Security Layer]  --> (Controls physical read/write execution on the disk)
               |
               v
    [QuickBooks .QBW Database]

• Network Share Permissions: Control access across the network path (e.g., \\Server\QuickBooksData). If the share is set to Read Only, users cannot write to the file, even if their underlying file system permissions are set to Full Control.
• NTFS Permissions: Control local file system access directly on the storage drive. This security applies whether a user connects over the network or logs in directly at the server console.

To ensure stability, QuickBooks requires that users have the ability to read, write, create, and delete temporary management files (.ND, .TLG, .DSN) within the shared directory.

---

Step-by-Step Permission Configuration

Step 1: Create a Dedicated Directory Outside the OS Root

Never store QuickBooks company files directly on the root of your system drive (e.g., C:\) or inside personal user folders (like Desktop or Documents).

1. Open File Explorer on the host server.
2. Navigate to a dedicated storage volume (e.g., D:\ or E:\), or create a root folder on C:\:
   • Example: D:\QuickBooksData\CompanyFiles
3. Move your company file (.qbw) and transaction log (.tlg) into this folder.

---

Step 2: Configure Network Share Permissions (SMB Layer)

Set the network share to allow authenticated users to connect over the network.

1. Right-click the folder (e.g., CompanyFiles) and select Properties.
2. Click the Sharing tab at the top, then click Advanced Sharing…
3. Check the box labeled Share this folder.
4. In the Share name field, enter a clean name (e.g., QuickBooksData).
5. Click the Permissions button.
6. Select the Everyone group and click Remove. (Removing “Everyone” prevents unauthenticated network guests from accessing the directory).
7. Click Add…, type Authenticated Users, and click OK.
8. With Authenticated Users selected, check the boxes for:
   • Change (Allow)
   • Read (Allow)
9. Click Apply, then OK. Click Apply and OK to close the Advanced Sharing dialog.

---

Step 3: Configure NTFS File Permissions (Security Layer)

Next, define exact access rights on the physical disk for both the database service engine and authorized users.

1. In the folder Properties window, switch to the Security tab.
2. Click the Advanced button near the bottom.
3. Ensure inheritance is enabled so subfolders receive the same rules, then click Edit (or return to the previous tab and click Edit…).
4. Configure the following specific accounts:

User / Group Account	Required NTFS Permission	Purpose
SYSTEM	Full Control	Required for core Windows background operations.
Administrators	Full Control	Allows local server maintenance and updates.
QBDataServiceUserXX	Full Control	Mandatory for the database engine to manage memory and locks.
Accounting Users Group	Modify, Read & Execute, Write	Grants authorized staff access to create and edit transactions.

1. Adding the database service account:
   • Click Add…
   • Under Enter the object names to select, enter your version’s service user:
     • QuickBooks 2024: QBDataServiceUser34
     • QuickBooks 2025: QBDataServiceUser35
     • QuickBooks 2026: QBDataServiceUser36
   • Click Check Names, then click OK.
   • Check the box for Full Control under the Allow column.
2. Adding authorized staff:
   • Click Add…
   • Enter the specific Windows user names or the local group containing your accounting staff (e.g., AccountingGroup).
   • Select the group and check the boxes for Modify, Read & execute, List folder contents, Read, and Write.
   • Security Note: Do not grant users Full Control. “Full Control” includes the ability to change permissions and take file ownership, which standard users do not need.
3. Click Apply and click OK to apply the security settings.

For details on how the database engine interacts with these folder rights, review Data Access: Using QBDBSM to Manage Folder Permissions and Access.

---

Step 4: Run a Verification Scan in Database Server Manager

After updating folder permissions, rescan the directory using the QuickBooks Database Server Manager to apply the changes to the network files.

1. Open the QuickBooks Database Server Manager on the server.
2. Go to the Scan Folders tab.
3. Click Add Folder and select the directory you just configured (D:\QuickBooksData\CompanyFiles).
4. Click Start Scan.
5. The tool will scan the directory, confirm permissions for the QBDataServiceUser, and regenerate the Network Data (.ND) file with updated access flags.

To review complete setup steps for the database service utility, consult QBDBSM Guide: How to Install and Configure Database Server Manager.

---

Testing Workstation Access Across the Network

Once permissions are saved, verify network access from a client workstation:

1. Log into a workstation as a standard accounting user.
2. Press Windows Key + R, type the direct Universal Naming Convention (UNC) path to the server share, and press Enter:
   \\ServerName\QuickBooksData
3. Verify that you can view the folder contents.
4. Test write permissions: Right-click an empty space, select New > Text Document, name it test.txt, and then delete it.
5. If you can create and delete this test file, file-system permissions are configured correctly.
6. Open QuickBooks Desktop and select your company file across the network path.

If users receive access errors during this test, refer to File Access: How to Map a Network Drive for QuickBooks Company Files.

---

Closing the Books

Securing your QuickBooks company file folder requires a balanced setup: granting the database engine full control while restricting user access to the specific rights needed for daily accounting work. Setting “Change” at the network share level and “Modify” at the NTFS level allows QuickBooks to maintain its lock and log files properly, while protecting your company’s financial records from unauthorized access and external security threats.