1

I've got a problem with a domain controller. It has a few shares an it, which are only visible to domain admins and users. Only these groups are added to Sharing and Security but even a Windows XP Home is able to see these shares and access them.

I was thinking of a special group policy which causes this. Any ideas?

2 Answers 2

2

Another thing to mention is that the Windows server service does not care about domain membership when shares are accessed. As long as the username and password of an authorized user are supplied, access is granted.

The username/password can be supplied explicitly while trying to access a share via GUI or mapping a drive via the "net use" command or implicitly via an automated NTLMv2 exchange if the local username and the password of the current local Windows XP user happens to match a valid user on the server.

4
  • Which means, I have to set the group Everyone to denied access to shares?
    – Sn0opy
    Nov 18, 2011 at 12:58
  • Doing so would deny access to the shares for everyone - including the users and groups which you have defined to allow access for. There is no way to work around this behavior - a valid username/password tuple will let you in, regardless of your client's domain membership status.
    – the-wabbit
    Nov 18, 2011 at 13:15
  • You could replace the Everyone group on the Share permissions with a group that only contains members from the domain. That would prohibit all non-domain users from accessing the share.
    – joeqwerty
    Nov 18, 2011 at 13:30
  • @joeqwerty I tried that already and it didn't worked. Even the WinXP Home was able to access the shares.
    – Sn0opy
    Nov 18, 2011 at 14:03
2

It depends on what exactly you mean by "only visible"; the act of browsing a computer is distinct from being allowed to access its shares, whether read-only or under full control.

With that in mind, there are actually 3 security levels on a share: browsing, read access, and full control.

Check group policy application (install and use the GPMC, it beats the old crappy system by a mile and a half), verify the entire top-down DACL tree for your share's physical location, and check the exact application and inclusion of all users and groups that have access to the share (not the physical location).

Unless you want to, as you said, prevent people from even browsing to a share, share access should typically be left at Everybody - Full Control; actual access control is better done through the filesystem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .