Joe, an employee, has just migrated from the Marketing department to the Accounting department and cannot save files to the Accounting share. He is a member of both the Marketing and Accounting…

NTFS Deny permissions take explicit precedence over Allow permissions across all group memberships for a user. Since Joe is still a member of the Marketing group, the Deny All NTFS permission applied to that group blocks his access to the Accounting share, regardless of the Accounting group's Full Control allow. Removing Joe from the Marketing group eliminates the Deny and allows the Accounting group's Full Control permission to take effect.

The permissions are not correct for Joe's current role; the Deny from Marketing overrides his Accounting access, so resaving will not resolve the issue.

The share permissions already grant Everyone Full Control, so changing the Accounting share permission adds no benefit and does not address the NTFS-level Deny conflict.

Removing the Deny permission from the Marketing group would affect all Marketing group members and could grant unintended access to the Accounting share, compromising security.