0

we have 25 clients in our shop, all running win 7 Each of them has D:/Samples which is updated periodically by syncing from the win server machine..

The sync process can be done by pushing the update from server, or each client sync manually from each PC (pulling from server)..

However each client can't share/sync samples content with each other because of virus risk .. (we were infected by nasty virus that spreads through LAN) So "allow write to everyone" permission is ruled out..

because of this we'd like to limit the write access of D:/Samples in all 25 PCs to one machine running windows server 2008...

So only the server has the right to write the samples folders of all clients, it should be read only, or better yet invisible to other 24 clients.. But each client also has access to the server Samples as read only for sync purpose

I'm new to Windows permission and it's still confusing for me.. I read the manual in the active directory but i think i don't see my case there... so is active directory what i need or can this be done through other means?

Edit: Apologize for being unclear i have added more details

I tried to draw a scheme [IMG]http://i957.photobucket.com/albums/ae55/deny_winarto/tempFileForShare_zps0jwjgiby.jpg[/IMG]

S = server A & B = clients

The old share permission method that allows everyone to write (bottom) Caused virus to spread among clients thats why we're trying to limit the write access now. Thanks

Improve this question
7
  • OK... I think I know what you're asking, but you still need a little more clarity. Do you want only the sever account to be able to write to theses shares, or to only allow write access form users looged onto/connected to the server? It makes a difference. Also, depending on which virus threat(s) you're concerned about, there's probably a better way than what you're asking. Is the virus problem you had CryptoWall or CryptoLocker, perhaps? (Ransomware that encrypts all of the specific types of files it can find, including those on the network.)
    – HopelessN00b
    Nov 20, 2014 at 8:32
  • Server account only i think, the clients don't have access to the server or the right to modify the samples (execute only).. i see... i'll take a look, we had nod32 when we were infected, so we prefer a more secure solution because the main cause of the spread was the permission..
    – denywinarto
    Nov 20, 2014 at 8:47
  • Well, if it really just is the server machine account that need wrote permissions, that's easy to do by removing write permissions from the share for everything except the machine account in question... though I doubt this is the case. An alternate, simple solution with network shares and crypto-ransomware is to enable shadow copies. Get infected? Oh well, find the source PC, disconnect it, and restore your encrypted files from a previous version.
    – HopelessN00b
    Nov 20, 2014 at 9:05
  • Yeah, it's that simple but i can't get the client to detect server account in "Specific People" option.. Is that the correct way or? I used shadow defender, but the sample folder can't be frozen because it's periodically updated
    – denywinarto
    Nov 20, 2014 at 9:11
  • Well, a machine account isn't generally considered people, so no, not the right way to do it. Try posting a screenshot, or a link to one so we can see what you're doing. The machine account name is generally the same as the machine name, followed by a dollar sign ($). in case that helps.
    – HopelessN00b
    Nov 20, 2014 at 9:16

1 Answer 1

Reset to default
1

Is the server with D:\Samples the same server you want to have the write access? If so set the NTFS perms to allow writes, and set the share perms to allow read only. Share perms are the most restrictive union of the 2 different permission types. Share perms do no affect local access, only remote clients

If D:\Samples is on one server and you want a different "server" to have write access... Permissions were designed to be user specific not machine specific. You could share the D:\Samples directory twice: First share name "Samples" and share perms Everyone=Read. Second share name "SamplesWrite$" share perms SomeGroup=Write. The dollar in the share name keeps the share hidden from browsing for users that should not know about it. From server2 use the UNC \server1\SamplesWrite$.

Improve this answer
1
  • Sorry for being unclear, i have added more details, the server cannot be writable by clients, and there's only one server. Windows permission is new for me.. But i think using your method the virus could still spread from one client to another because i used to hid it before and most of our computers were infected by nasty virus :( ...
    – denywinarto
    Nov 20, 2014 at 8:09

Not the answer you're looking for? Browse other questions tagged .