1

How to configure a server [having DNS and ADS roles installed user account created/configured] to restrict its shared folder access to a specific computer in the network.

Sol-1: Solution proposed here https://superuser.com/questions/629099/how-to-block-an-ip-address-from-a-network-share doesn't work as "Windows Security Model restricts access per-user, not per-IP"

Sol-2: Another solution proposed here: https://support.managed.com/kb/a482/block-an-ip-or-ip-range-using-windows-ip-security-policy.aspx is completely blocking the connecting computer/IP as a result, specific computer (nomiated to block shared folder access) is even unable to resolve ADS user's credential when tried to logon.

More Details

Goal

We want ADS users (around 30 in numbers) on a company network to browse internet without any restrictions, download whatever they want, but prohibit upload of company data to cloud.

Situation

To satisfy this need,

  • Hosted a domain server with ADS setup. Call it MAIN-SERVER.

  • None of the users' computers are connected to internet, but they are all LANed.

  • No user is allowed to share a folder from his/her computer on the LAN.

  • We placed another server (call it NET-MACHINE) that is connected to internet and it is also connected to MAIN-SERVER (it has 2 network cards). All users who wish to browse internet can connect to NET-MACHINE through Remote Desktop using their ADS credential.

Now, users sometimes want to download something and use it on "their" computer, so there is a shared folder on NET-MACHINE, that is read-write on NET-MACHINE machine but read-only when accessed as shared folder over network.

Challenge

Users sometimes want to share data with their colleagues. So, there is a shared folder on MAIN-SERVER that is read-write for all users on network. Now, here is the interesting thing, this shared folder on MAIN-SERVER is also accessible to NET-MACHINE which we want to restrict. When a user logs in to NET-MACHINE using RDP, they shouldn't be able to access the shared folder on MAIN-SERVER.

Request

  1. I am novice to this computer networking stuff, so please feel free to comment if you see any other reliable approach to manage users to restrict upload but in the same time give them complete freedom to surf net.

  2. How to restrict NET-MACHINE to access shared folder on MAIN-SERVER

Improve this question
8
  • 7
    This seems like a really silly way to go about this. You company should be looking into Data Loss Prevention software and systems. What happens in your setup when someone brings in a usb stick and copies all the data onto it?
    – HostBits
    Dec 19, 2014 at 13:34
  • 2
    Welcome to Server Fault! Questions on Server Fault must demonstrate a minimum understanding of the technology in question. Otherwise, the post often turns into a discussion forum, instead of straight Q&A. The best advice we can give you is to hire a consultant to help you out or do further research on the basics of this technology.
    – TheCleaner
    Dec 19, 2014 at 13:38
  • 1
    Even better, what happens when someone brings in a camera and take a photo of their screen?
    – tombull89
    Dec 19, 2014 at 13:40
  • 2
    @tombull89 This is the exact reason why DLP is useless to stop intentional data leakage (well, that and/or the existence of pen and paper). The only thing it can do to any degree is stop the accidental leakage of data.
    – HopelessN00b
    Dec 19, 2014 at 13:49
  • 1
    Guys! proposed setup is already implemented in one of the business premise and users are very happy as they now have unrestricted access to internet compared to previous facebook blocked/gmail blocked/dropbox blocked policies. Every user is having dual monitor, they find it easy to switch between local and remote computer screens placed side-by-side. Requesting geeks to suggest technical solutions or possibilities so that users have unrestricted internet access and company also enjoy secured environment setup.
    – Pavan G R
    Dec 19, 2014 at 15:51

1 Answer 1

Reset to default
4

In response to your comment:

Your comment is valid if the data I want to protect is some kind of business deeds with sensitive financial figures. But, consider I am doing it for a software company that wants to protect their programmers to upload their software source files to their private cloud storage (they are usually 1000+ files).

and your comment in reply to Reaces:

I have gone through the link that you pointed in your answer before posting this question, but what i found out is Windows Security Model restricts access per-user, not per-IP. The post didn't help me much. After searching on the net, I found this, support.managed.com/kb/a482/… but it is completely restricting NET-MACHINE to access MAIN-SERVER.

Well, yes. You don't want them to access their MAIN-SERVER files while browsing the internet. It sounds like MAIN-SERVER is a massive dumping ground for sensitive source files. The way to keep them from uploading files from MAIN-SERVER via NET-MACHINE is to block NET-MACHINE from talking to MAIN-SERVER, either by permissions or by IP.

I'm going to agree with Cheekaleek and the other commenters that what you want is really some kind of Data Loss Prevention Software. (I had a friend who was working on one of those before he moved to a new company. He unenthusiastically referred to it as "man-in-the-middle attack on your own users." However, well. If it's vital that your stuff not leave your premises... better than then an unenforced policy, IMHO.)

I'm also going to question your MAIN-SERVER share. (Sorry.) Your programmers want to share files with each other. Forgive me, but I used to work at a small company where this wasn't the case--you are using source control, right? I mean, I'm trying to figure out what the thousands of files they're sharing in a network share might be otherwise. If not, you probably want to set up something like that as well.

Improve this answer
1
  • 2
    Ofcourse, the source control is used and the scenario may not be sharing source file to each other when they have direct access from SCM. But in a day-to-day activities, think of someone wish to share a large SDK file (which she downloaded) for evaluation with another programmer..there can be any smaller file thing members quickly want to share with others in the team and doesn't have be the source file all the time. DLPs are expensive, as of now, going for it out of scope.
    – Pavan G R
    Dec 19, 2014 at 14:43

Not the answer you're looking for? Browse other questions tagged .