1

I have just setup a server 2012 essentials R2 box as a test bed for my small business. Its running Essentials R2 as a VM on a Essentials R2 host. I have set it up to be the DC and DHCP server and joined a client.

My next task is to use it as a file server but I am not quite sure how to set it up. All the client interactions with the file server will be through client side software. I therefore do not want any access to the files apart from through the software.

I have looked at the ntfs permissions and there is a permission called "List Folder/Read Data" however I am unsure this will do what I want.

Is it possible to give access to the files but not allow access through the windows explorer / command line?

1

1 Answer 1

2

It depends on how, exactly, the application interacts with the file and the user.

The root question is: "Is there a way to use a different security principal that the one from the user login session to access the file" ? If the answer is "no", then you can't restrict it.

More pragmatically:

If the application is a traditional desktop application used either remotely (application running on the client's computer accessing the file through a SMB share) or locally (for instance through Terminal Services), then no, you usually cannot restrict the access to the file using permissions because the process uses the user's identity to access it.

If the application is a n-tier application (for instance, a web app), then you usually can put extra restriction on data file access: you restrict the rights of the users and allow whatever level of access is necessary to the security principal that will be used (that's usually done by assigning a specific service service account to the relevant process). Be mindful, however, of the fact that it is possible for a n-tier application to impersonate the user access token. In such a case, you should make sure that the files you want to protect are, in fact, not available though SMB at all (for instance, by placing them into a drive or folder that is not accessible from any SMB share available to the users).

Note that, regardless of what the answer to the above it, if the application supports UNC path, you could make it less likely for the user to access the file by hiding it under a hidden network share. All you need to do to hide the share is to add a dollar sign ($) at the end of it's name. It will not prevent anyone but the less tech-savvy users from acessing the file should they want it but it might prevent accidents.

1
  • Thanks for the response. The main data I wanted to secure was an Access Database file that sits on the file share. As far as I can tell from your response and further reading it is not possible to do what I want. As far as I can see my best bet is to obscurate the file share as you said by hiding it and by disabling access to the network browser for clients in windows. Thanks for the help Nov 12, 2013 at 11:40

Not the answer you're looking for? Browse other questions tagged .