Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I look after a network where the servers are Server 2008 [Domain controllers] and the client stations are either Windows 7 Pro SP1 64 Bit or Windows XP Pro SP3 32 Bit.

I have configured GPOs to protect the workstations/servers and the network generally and I am happy with most of this. However when a user clicks 'Save' or 'Save As' in an application they can type a UNC path to a server or a client and see any shares that are not hidden.

\\Server1\

or:

\\Workstation1\

I would like a way of blocking this. Some of the server shares I have created [for operational reasons] are not hidden and are open to all users to make modifications to. Even if the shares were hidden if the users knew the path to the share then they can still open that share]

Is there a way of preventing the users form entering a named UNC, like \\server1\ without adversely affecting the performance of the workstation or the network?

share|improve this question

migrated from stackoverflow.com Aug 14 '11 at 15:32

This question came from our site for professional and enthusiast programmers.

    
I don't know if this is the place to ask. I mean, wouldn't it be better to post on Superuser? –  Rekin Aug 14 '11 at 15:15
4  
I'd be looking at fixing the share security on the networking side, vs. trying to fix it this way. –  Joe Aug 14 '11 at 15:21
9  
This is a little like asking "what is the most secure doormat to hide my house key under"; the obvious answer is, if you are concerned about security, don't leave your key under the doormat at all. Ultimately, a user can enter net view Server1 /all in the command prompt to view even hidden shares, and there are other ways for the user (or malware the user unwittingly executes) to do the same. The correct approach is to set up appropriate share and NTFS permissions on servers and workstations, not to enforce UI-level restrictions that prevent the user from seeing the vulnerable resources. –  drf Aug 14 '11 at 15:33
1  
drf; that's answer quality right there! –  p.campbell Aug 14 '11 at 15:35
    
@drf - He has the answer you are looking for. I would move your answer from the comment to an answer, as this is the answer to the question. –  Nixphoe Aug 14 '11 at 15:58

1 Answer 1

If @drf doesn't want to post his comment...

This is a little like asking "what is the most secure doormat to hide my house key under"; the obvious answer is, if you are concerned about security, don't leave your key under the doormat at all. Ultimately, a user can enter net view Server1 /all in the command prompt to view even hidden shares, and there are other ways for the user (or malware the user unwittingly executes) to do the same. The correct approach is to set up appropriate share and NTFS permissions on servers and workstations, not to enforce UI-level restrictions that prevent the user from seeing the vulnerable resources.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.