3

I want to share common data within a cluster of servers via network shares. There will be one share folder on each server, which all the other servers can access. The server processes that will be accessing this data are currently running as SYSTEM. I would like to restrict the permissions on these folders so that only the processes running on the other servers in the cluster can access the share. I do NOT want the network shares to be accessible to anyone else in the domain (except perhaps the admins who can remote into the servers anyway).

How do I configure the permissions on the file shares to accomplish this? Can it be done with the server processes running as SYSTEM? If there is no direct way to do this, is there a best practice work around?

We are running Windows Server 2008 R2.

Thanks, Jeff

Improve this question

2 Answers 2

Reset to default
3

In a terse, step-by-step fashion:

  • Create a group and make the AD computer accounts for the cluster computers members of that group.

  • Set the NTFS permissions on the folder to "SYSTEM / Full Control", "MACHINE\Administrators / Full Control", and "The Cluster Member Group / Full Control". (I always include "MACHINE\Administrators" and "SYSTEM" with "Full Control" in virtually every permission I apply. Call it force-of-habit...)

  • Share the folder and set the Share Permission to "Everyone / Full Control". This effectively nullifies this "feature". The NTFS permissions will enforce the security you're looking for.

  • You're in business.

Improve this answer
2
  • Remember -- Changes made to various settings that affect SYSTEM accounts and MACHINE accounts do not take effect until and unless the machine in question is rebooted. For example, change and ENVIRONMENT variable for SYSTEM, no change until reboot. Likewise, add a machine account to a group, no change until the machine is rebooted. Forgetting this can result in a massive dose of frustration...
    – SvrGuy
    Jun 25, 2011 at 20:36
  • That's exactly what we discovered over the weekend. We were banging our heads trying to see if we were following the instructions correctly until we tried the old Windows default - reboot. Now everything is working perfectly.
    – Jeff D.
    Jun 27, 2011 at 15:28
0

I believe you can do this by having the services run not as SYSTEM but as NetworkService(1). This allows the service to use the computer's Active Directory account on the network. Once you've done that, you can create an AD group containing the machine accounts of the servers that need access to the share. You can then set the Share permissions to only allow access from that created group. For extra protection, you can also set the NTFS permissions to allow modify from that one group, admins, and nothing else.

(1) Am remote, this may be doable with pure SYSTEM. Will double check when I have bandwidth

Improve this answer
1
  • 1
    On domain members SYSTEM access to remote machines via Microsoft File and Print Sharing is done using the machine's domain credential. I use it all the time. I'm negative on the recommendation to use Share Permission, though. For my money, The Right Way(tm) to do security for shared file resources is to put the permissions on the NTFS and set the Share Permission to "Everyone / Full Control". There might be a way to get at the files besides thru LanManServer (which enforces Share Permission) but there's no way to get around NTFS permissions.
    – Evan Anderson
    Jun 24, 2011 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.