permissions - Windows server share read-only from network and write locally

Question:

How do I Deny Change without Denying Read on Windows File Share Permissions?

Details:

I have a Windows 2012 R2 server. I would like to create a file share that is read-only to a group when accessed from the network (via the file share) but writable when the members of the group are connected via Remote Desktop.

I thought I would be able to accomplish this by making the folder writable from file permissions but deny write using the share permissions.

I am unable to set 'Deny Change' without also being forced to 'Deny Read' in the share permissions dialog. (I don't want to deny read...)

Answer

Local perms consist of only NTFS perms. Effective share perms are the union of the NTFS perms + the share perms. Just make the share perms read only.