Leos Marek

@gibon @swapnilkambli We don’t have physical access. We have to access the server remotely and then create local admin account on the server

@gibon Please let me know What does it mean.

@gibon @swapnilkambli The PC is not in domain. It’s a workgroup server.

@gibon

Keep in mind that SMB permissions and NTFS permissions are different.
You have to set both.
And the command you provided is for new shares.
To set permissions on existing shares we must use Revoke-SmbShareAccess to remove permissions and Grant-SmbShareAccess to add permissions.
However, best practices are to keep the following basic permissions on every share:

• Administrators : Full
• Everyone : Change

You can then fine tune NTFS permissions because they are mutually exclusive with SMB permissions.

For example,  if your group or account has NTFS Read permissions, your global permission will only be Read permissions even if you have SMB Full permissions.