Can I globally prevent the security settings for shares from being changed?
This is not possible globally, but only for each share individually.
You can use the Windows tools to set the permission. But there is also a command line tool “sharesec”, with which it is possible to set the desired permissions.
There is a good description here:
Sharesec could be used like this:
sharesec testshare -m S-1-1-0:ALLOWED/0X0/CHANGE sharesec testshare -a S-1-5-21-2438365080-1175145288-4246282840-512:ALLOWED/0X0/FULL sharesec testshare -v-view-all REVISION:1 CONTROL:SR|DP OWNER: GROUP: ACL:S-1-1-0:ALLOWED/0x0/CHANGE ACL:S-1-5-21-2438365080-1175145288-4246282840-512:ALLOWED/0x0/FULL