I've got a problem with a domain controller. It has a few shares an it, which are only visible to domain admins and users. Only these groups are added to Sharing and Security but even a Windows XP Home is able to see these shares and access them.

I was thinking of a special group policy which causes this. Any ideas?


Another thing to mention is that the Windows server service does not care about domain membership when shares are accessed. As long as the username and password of an authorized user are supplied, access is granted.

The username/password can be supplied explicitly while trying to access a share via GUI or mapping a drive via the "net use" command or implicitly via an automated NTLMv2 exchange if the local username and the password of the current local Windows XP user happens to match a valid user on the server.

| improve this answer | |
  • Which means, I have to set the group Everyone to denied access to shares? – Sn0opy Nov 18 '11 at 12:58
  • Doing so would deny access to the shares for everyone - including the users and groups which you have defined to allow access for. There is no way to work around this behavior - a valid username/password tuple will let you in, regardless of your client's domain membership status. – the-wabbit Nov 18 '11 at 13:15
  • You could replace the Everyone group on the Share permissions with a group that only contains members from the domain. That would prohibit all non-domain users from accessing the share. – joeqwerty Nov 18 '11 at 13:30
  • @joeqwerty I tried that already and it didn't worked. Even the WinXP Home was able to access the shares. – Sn0opy Nov 18 '11 at 14:03

It depends on what exactly you mean by "only visible"; the act of browsing a computer is distinct from being allowed to access its shares, whether read-only or under full control.

With that in mind, there are actually 3 security levels on a share: browsing, read access, and full control.

Check group policy application (install and use the GPMC, it beats the old crappy system by a mile and a half), verify the entire top-down DACL tree for your share's physical location, and check the exact application and inclusion of all users and groups that have access to the share (not the physical location).

Unless you want to, as you said, prevent people from even browsing to a share, share access should typically be left at Everybody - Full Control; actual access control is better done through the filesystem.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.