Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I create a truly anonymous read/write network share in Windows Server 2008?

That is ...

  • no login dialog shown
  • no domain credentials required

... so that any Windows machine can get to this share no matter who is logged in, whether the machine is on a domain or not?

share|improve this question
add comment

2 Answers

I was able to get a rudimentary anonymous share going by setting the share and filesystem permissions to:

  • Everyone (full control)
  • Guests (full control)
  • ANONYMOUS LOGON (full control)

After that, in the Local Security Policy under Local Policies > Security Options I had to modify

Network access: Shares that can be accessed anonymously

by adding my share to it, like so:

sharename

At that point I was able to get to \\servername\sharename anonymously.

share|improve this answer
1  
Can't say I'd ever done it via that route. That's more sensible than my posting because it doesn't radically decrease the server's security. I'm blowing away my answer on that basis and upvoting you. –  Evan Anderson May 22 '11 at 9:31
    
@evan I'm not 100% sure this is entirely correct so I want to hear others' opinions on it –  Jeff Atwood May 22 '11 at 9:35
    
It's better than enabling the "Guest" account, IMO, because it's really easy (especially with abuse of the "Everyone" principal in permissions) to "leak" access to "Guests". Having said that, enabling the "Guest" account is a bit faster to do than this. I'm not sure that's a positive thing, though. I've spent a lot of time in my life trying to get people not to enable the "Guest" account. –  Evan Anderson May 22 '11 at 9:36
2  
i tried both but i still get unknown user name or password error. What more do i need to do? i am having a win2k8 server r2 box –  Anirudh Goel Jan 30 '12 at 13:38
    
+1 for actually giving the text to put in the parameter, since the format doesn't seem to be documented anywhere –  rakslice Jul 31 '13 at 19:19
add comment

You need to enable the "Guest" account on the Windows Server machine. After you do that, assuming the remote user isn't attempting to logon with a user account that's valid on the Windows Server machine, you'll get what you're looking for. It can be a pain, though, because you'll get logon dialogs on the remote computers if the user account being used on the remote computer matches an account that's valid on the Windows Server machine. The standard "workaround" for that is to rename the local "Administrator" account on the Windows Server machine to something else and refrain from creating any addt'l user accounts.

You'll need, obviously, appropriate share and filesystem permissions on the shared folder.

share|improve this answer
    
that's a great point about the account overlaps, if you happen to "accidentally" match an account on the target machine. Would not have thought of that. Another point to consider: if the account attempting to get to this anonymous share is, say, LOCAL SYSTEM or NETWORK SERVICE .. those accounts are just plain banned from touching the network, period, so it doesn't ultimately matter what the permissions are. (I undeleted this post because I still think it is useful..) –  Jeff Atwood May 22 '11 at 9:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.