Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite
1

We have, at the moment, over 23 mapped network shares, and we are running out of letters. Each network share is nothing else than a folder on a file server (CIFS).

We're thinking of mapping one letter to a root network share (which is on file server) where all folders are and use ACL. Depending on his security group user can see certain folders and he cannot see others.

What should be the proper way of using these shares?

share|improve this question
I'm not clear what you're asking, but I think you want to look into Access-based enumeration. This feature will hide directories to which users do not have access. – jscott Jul 2 '12 at 12:23
@jscott: that feature is enabled by default on newer versions of Windows Server, isn't it? If the user doesn't have read access to the folder it doesn't show up in the share? – Bart Silverstrim Jul 2 '12 at 13:38
@BartSilverstrim The feature is now included in Server 2008 (or higher), it is disabled by default. But yes, it displays only the files and folders that a user has permissions to access. – jscott Jul 2 '12 at 13:43
@jscott: I think it's enabled by default depending on how you create the share. From the article: "On a computer that is running Windows Server 2008, access-based enumeration is enabled by default on every folder that is shared by using the File Sharing feature. (This is the default sharing feature that is available through Windows Explorer). However, access-based enumeration is not enabled by default on the following types of shared folders:"... – Bart Silverstrim Jul 2 '12 at 13:51

2 Answers

up vote 4 down vote

I'm not sure what you're looking for in the question; normally it shouldn't matter if you can see the parent folder, but if you have access to it or not. All you'd do, if the server is NT-based, is change the security so only a particular group has any access, and remove anyone else in the security list. Even if someone sees "ted-confidential" as a folder, clicking on it would yield an error message.

That's always been the simplest method to use in our organization, and simpler usually means less hassle with maintenance down the road.

share|improve this answer
Agreed, you should group data in to departments (e.g. Accounts, Sales etc), assign each a drive letter, add all accounts users to an accounts group etc, use share permissions to provide all accounts users full control to the accounts shares etc, then use NTFS permissions per sub-folder to allow full-rights, read-only or no access, depending on what is required. The end result will be that users will be able to see folder names but could only view their contents if allowed. – Alex Berry Jul 2 '12 at 12:24
up vote 2 down vote

Do not use mapped drives. In my organization we have ONE - N. N for Network.

From there on we have a DFS hierarchy that then ends in folders that may be on different servers or not, but it is all handled in the DFS layer.

Do NOT (!) map one letter in a root share - use DFS, otherwise you open yourself up to scalability problems.

share|improve this answer
DFS is good but, by the sounds of it, probably a little overkill for less than 26 folders. – Alex Berry Jul 2 '12 at 13:35
Why? It has zero overhead to set up, takes maybe 15 minutes + time for folders and makes sure you do not require reorgnaization a year down the road. Plus it allows replication on top which may come in handy later. – TomTom Jul 2 '12 at 14:20
It adds an extra layer of complication and administration overhead, I just don't see it as necessary in a (what sounds like) small business environment. – Alex Berry Jul 2 '12 at 14:26
Well, 90% of small business environments do not blow 20+ network shares, to start with. That leads your argument ad absurdum in the start. – TomTom Jul 2 '12 at 14:30
3-8 shares is quite normal, DFS, unless necessary, is not. – Alex Berry Jul 2 '12 at 14:33
show 7 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.