Your network contains an Active Directory Domain Services (AD DS) domain named adatum.

User1 can read the files in Share1: Yes. User3 can delete files in Share1: No. If User2 connects to \\Server1.adatum.com from File Explorer, Share1 will be listed: Yes.

When a folder is accessed across the network through its share, the effective permission is always the more restrictive of the NTFS permission and the share permission evaluated together. User1 belongs to Group1, which has NTFS Read and share-level Change; the combined effective permission is Read, so User1 can indeed read the files in Share1. User3 belongs to Group3, which has no NTFS permission entry at all on D:\Folder1 (only Administrators, Group1, and Group2 appear in the NTFS ACL, with no inheritance from a parent granting Group3 access), even though Group3 holds Full Control at the share level; because NTFS grants nothing to Group3, the combined effective permission is no access whatsoever, so User3 cannot delete, read, or otherwise touch the files, regardless of the generous share permission. The third statement concerns Access-Based Enumeration (ABE), which Windows exposes on a share through its folder enumeration mode: Share1 ' s FolderEnumerationMode is set to Unrestricted, meaning ABE is disabled for this share. With ABE disabled, every share is listed to every user browsing \\Server1.adatum.com regardless of that user ' s actual access rights, so Share1 will appear in the listing when User2 (Group2, which has no share permission entry and effectively no access to the share ' s contents at all) browses to the server, even though User2 could not open the share ' s contents once inside. ABE only hides shares from users with zero effective access when it is explicitly enabled (AccessBased mode), which is not the case here.