Windows 2008 R2 SP1 Foundations file server with no AD, only workgroup sharing some folders, and now a RRAS server. Shared folders are open to everyone in the office (XPs and Sevens) without accounts/passwords, but I was thinking about partially limiting access to the new "VPNuser" account. I'm new to Windows Server and its permissions settings: I thought about denying access to vpnuser through NTFS rights in some folders. It doesn't work, but now I'm guessing that the vpnuser is not considered as a logged user (doesn't appear as such) and is considered a "guest", like the rest of people connecting in the office.

I say that because of this: http://social.technet.microsoft.com/Forums/windowsserver/en-US/ff6d3726-ff41-4d3f-9d97-5361af0206dd/vpn-users-on-server-shows-as-guest?forum=winserverNIS Also, because when I create a txt file using the VPN connection, owner field shows in description as "guest".

Am I right? How can I set different rights for the VPNuser from the rest of "guest" users in the office?

  • How exactly is the VPNUser account being used?
    – squillman
    Commented Nov 1, 2013 at 14:44
  • Hi squillman, VPNuser was created just for the VPN connection (standard user with Dial-in access allowed, there's no domain). Its only purpose is to have access to the shared folders from home, but I'd like to restrict it to only a couple of the shared folders.
    – Sebas
    Commented Nov 1, 2013 at 14:55

1 Answer 1


If you want to restrict the access of a specific user, you can simply change the security permissions on the folders you want to limit. (Deny write comes in handy here). The thing you need to make sure of is that you only allow access through the VPN to whatever group you have set up for remote access, otherwise your permission settings will be useless.

All you need to do is set up a group in ADDS for VPN users, and make sure they are the only ones able to connect to RRAS.

That said, you can simply switch the permissions of that group to be deny write on everything, which will still allow them to traverse the filesystem, but not change anything. Then set the access for their folders to whatever you want. (making sure to turn off inherited permissions).

That being said, it might be simpler, if all they need is file access, to set up a SFTP server, and force it to CHroot them to whatever their home directory should be. (*dont know much about your configuration)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .