Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In our office we have a domain controller and all employees' machine join the domain. We have new tenants starting soon sharing our internet connection in the office. They won't join the domain and of course shouldn't be able to access our network drive which is on the domain controller.

Is there a way to deny their access to our network drive? The domain controller runs window server 2008 r2.

Thanks,

share|improve this question
5  
Why not split the LAN at the firewall/internet connection into two different LANs either with hardware or VLANs/etc.? –  TheCleaner Dec 20 '12 at 21:04
1  
What TheCleaner said (and I said, too :-) –  mfinni Dec 20 '12 at 21:15
    
Don't forget to mark a correct answer. –  mfinni Dec 21 '12 at 23:34

1 Answer 1

Ensure that you have not assigned permissions on anything to "anonymous" or "everyone". This will be easiest to check on the share permissions themselves. If you do find those permissions set, change them to "Authenticated users", and you should be good. The only thing this will break will be if you have any non-authenticated access from your own devices; you probably (hopefully) don't. If you do, now's your chance to fix it!

This is a best practice, and is likely already configured. You can do likewise with NTFS permissions on files and folders, but that might take a long time to fix.

But really, you should also segregate the other company into their own VLAN; they shouldn't have to sit in your subnet to share your internet connection.

share|improve this answer
    
The "everyone" security group does not contain the "anonymous logon" user account since Windows XP/Server 2003. If only users in the domain should be able to access the share the everyone group is the correct one to use. But if only "domain users" or other specific domain security groups should be able to use the share more appropriate groups should be used. –  Molotch Dec 22 '12 at 14:09
    
Good to hear that changed. –  mfinni Dec 22 '12 at 16:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.