I have a couple of shared folders which are accesible by an account which has no password (long story). But the username is very long and difficult.
Is this (relatively) safe and secure, or is it possible for remote machines in the LAN to query the existing usernames on the PC?
You/OP obviously already knew what most here would say, seeing as how you stated "long story" when you mentioned the null password.
On paper there are various security methodologies/practices, etc. that are very valid.
In reality, it is up to you and your organization to decide what security practices you will follow (or which ones are required by law if you are subject to regulations, etc.).
If you and your company feel that the current setup is ok, then it is. People might say "That's so stupid!" and their opinion is just as valid as you saying "this is what we've chosen to do". It's not any different than painting your house zebra stripes. Most will ridicule and shake their heads, but in the end it is your call.
As others have mentioned, there are ways to query a remote computer, dependent on the tools/rights/skills of the person trying to figure this out.
No it is not safe or secure to use a difficult user name with no password as the means to control access to a network share, for a number of reasons.
And yes, you can enumerate local users on a computer with the "net user" command. And you can run commands remotely on computers with tools like PSexec and other methods, see the link below for detail. Whether or not it would be possible for someone to do this would depend on your configuration.
http://4sysops.com/archives/three-ways-to-run-remote-windows-commands/
There are other ways as well in which you can determine what user accounts are on a computer, such as with WMI. Once again if this is possible for someone else to do, would depend on your configuration.
tl;dr What you did is very bad idea from a security perspective.
If a user has enough rights on this machine(for example a local administrator) it is possible to get all shares and its permissions. This can be done with scripts or consoles like "Computer Management"(on Windows).
I don't know exactly which rights are necessary but this is not a good way to secure a share.
If the user does not have access to the computer other than the share path, it should not be possible to list the share permissions without granted access. You are using the username as a password which I think you know is not good practice. The share would then be susceptible to brute force attacks since the password lockout policy will not be triggered since you are using different user names. The username might also be retrievable somewhere else depending on the environment (domain? access level of the user). In short it is more difficult to access but not safe. Consider the impact and alternatives in addition to the likelihood of a breach before settling on this method.
