Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a folder on my Windows Server 2003 that I'd like to share with all computers on the network, but I want to force people to input a password (at least initially) to connect to the share. I tried adding a password to the "Guest" account, but it never asks for a password. I've tried setting up a separate account with a password, but I get "Windows cannot access \server\" message. What's the best way to accomplish what I'm trying to do?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

(I am assuming you are doing this with a standalone server and clients that aren't members of a domain.)

  • Disable the "Guest" account on the server.

  • After you've done that, create an account on the server computer with the username / password that you want users to use.

  • Set the "Share Permissions" on the shared folder to "Everyone / Full Control" (assuming that you're sharing folders on an NTFS volume). There's no reason to use "Share Permissions" if the underlying filesystem is NTFS-- it will just complicate things. (If I could somehow influence Microsoft to do anything I'd have them remove this functionality.)

  • Modify the NTFS permission on the shared folder to allow the user you created above to have the type of access you require (Read, Full-Control, etc). (Don't name "Everyone" unless you mean "Everyone in the world".)

  • Finally, when you "connect" from the client computer and are prompted for credentials, be sure you enter the credential as "SERVERNAME\Username".

  • The behavior of Windows Explorer, in my experience, has been spotty. I'd try the following from a command-prompt on client computer just to be sure:

    NET USE * \servername\sharename /USER:severname\username password

If that works, but Windows Explorer isn't prompting for credentials, you probably have credentials saved by Explorer that need to be cleared.

The "Guest" account's enabled / disabled status is interpreted by the OS as a "flag" that says "Allow unauthenticated users to connect..." versus "Do not allow authenticated users to connect..." (I am glossing over some details here, but this is basically true.)

share|improve this answer
    
I disabled the "Guest" account, and I removed the "Everyone" from the share permissions, but I still get "access denied". Do I have to have an account on the server that matches the account on the client accessing the share, or can I create a different account? –  Michael Kelley Jun 22 '09 at 18:43
    
Thanks for the detailed response! Unfortunately I never get the credential prompt from the client computers. –  Michael Kelley Jun 22 '09 at 18:47
    
And yes, the server is standalone and clients aren't members of a domain. –  Michael Kelley Jun 22 '09 at 19:00
    
I threw some more information into the post. –  Evan Anderson Jun 22 '09 at 19:01
    
The one reason behind the share permissions that I like entirly is the difference between "everyone" and "domain users". –  reconbot Jun 22 '09 at 19:13
show 2 more comments

We would set the share permissions to Authenticated Users full and set proper NTFS permissions on the folders being accessed. Authenticated Users not Everyone. D'oh!

share|improve this answer
add comment

You need to make sure that the Everyone groups does not have permission on the share, because the Everyone groups really does include everyone, even unauthenticated users. Instead give permission to a specific user or group to force authentication to the folder.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.