I am in the long and arduous process of resolving my confusion over Windows permissions, and would love to get some clarity over the following.
I would like to provision a Windows share such that any anonymous Windows computer on the network (we do not use a domain controller) can type
\\servername\sharename and have read-only access to the files therein.
What I know:
- The "Everyone" group does not include the "anonymous" SID. (Though strangely, that article doesn't "apply" to 2008 R2...)
- There are two "levels" (probably not the best word) of permissions on the files themselves: the Share Permissions and the NTFS Permissions. (i.e. Share and Storage Management -> Properties -> Permissions)
- There are some gotchas about operating in an environment without a domain controller but with identically-named user accounts on multiple machines.
What I think I know:
- "Making Network Services Discoverable" should have no impact on the accessibility of properly-permissioned shares.
- NTFS permissions must ALSO be configured for this share to be accessible -- not just share permissions!(?) (Despite Share and Storage Management claiming they only apply to local access.)
- The "Everyone" group should not be left out of access permissions even though it explicitly refers to local user accounts, BECAUSE a client computer logged on as the same username as one local to the server will try to authenticate as that user, and be denied if there is a difference in password. (
What I don't know:
- Are there any gotchas having to do with cached credentials or server response? Should I reboot my test client workstation after every attempt to connect to the share?
- Should the "Guest" account have anything to do with this, on either the share or NTFS permissions?
- Am I correct in observing the need to configure "ANONYMOUS LOGON" with read permissions on BOTH the share and NTFS permissions? Same for "Everyone" group?