Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a W2K3 Server, with certain directories shared on a couple of different drives. Both drives (C and D) have the default admin shares in place.

When any domain user is logged in, that user can Start->Run->server_ip and view a list of all shared folders.

Can I keep this from happening?

I'd like only domain admins to see this.

This probably reveals that I've got many other things wrong already, but it's my start point.

Advice?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

You're looking for Access Based Enumeration. Download from Microsoft for Server 2003 SP1 or R2.

Once installed you can either globally enable it; or enable it on the Properties of individual shared folders.

share|improve this answer
    
I suppose I have a deeper problem, though this will definitely help. In our case, I can't get the access perms to work. I have edited a share, first removing all access groups. Then I added Domain Admins to the group. I then logged in as an AD user belonging only to Domain Users, and could access the folder. Gah! –  Ducain Sep 14 '10 at 18:52
    
"Then I added Domain Admins to the group." - ?? Is this share permissions or NTFS permissions? They're separate and both have to be configured correctly. –  Chris S Sep 14 '10 at 19:24
    
Sorry - I'm an app developer being forced to check out server management stuff (don't get me started). To clarify, I removed all groups from the share permissions, and then added the Domain Admin group. Should this not limit access to this folder to only users signed in that belong to the group Domain Admins? –  Ducain Sep 14 '10 at 19:25
    
I'm marking this as the answer because technically this would address the exact question I asked. I have other issues going on, but not regarding this question it seems. –  Ducain Sep 14 '10 at 19:29
    
@Duncain - as Chris S mentioned, there are Share permissions, and then Security permissions - different tabs on the folder. Usually, you need to set Share permissions to Everyone [Full Access], and then set who can access it in the Security permissions tab –  Izzy Sep 15 '10 at 4:05

This probably reveals that I've got many other things wrong already, but it's my start point.

Actually, it doesn't. Without Access-based Enumeration, all authenticated users will see a list of all shares when looking at \\fileserver. That's the way it works. Whether or not they can open a shared folder and view any of the contents depends on the ACLs that you set - but everyone should be able to see all the non-hidden shares. That's why they make hidden shares (\\fileserver\$Sharename) - in case you want to hide them.

share|improve this answer
    
Thanks, cleared that up for me. –  Ducain Sep 14 '10 at 19:27
    
Yes, to "hide" a share, you needs a sharename with a $ at the end. The admin shares are C$ and D$ so thats why they can't see them. –  Tubs Oct 13 '10 at 14:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.