What are the minimum permissions for a Windows share to be anonymous-read only?

Question

I am in the long and arduous process of resolving my confusion over Windows permissions, and would love to get some clarity over the following.

I would like to provision a Windows share such that any anonymous Windows computer on the network (we do not use a domain controller) can type \\servername\sharename and have read-only access to the files therein.

What I know:

• The "Everyone" group does not include the "anonymous" SID. (Though strangely, that article doesn't "apply" to 2008 R2...)
• There are two "levels" (probably not the best word) of permissions on the files themselves: the Share Permissions and the NTFS Permissions. (i.e. Share and Storage Management -> Properties -> Permissions)
• There are some gotchas about operating in an environment without a domain controller but with identically-named user accounts on multiple machines.

What I think I know:

• "Making Network Services Discoverable" should have no impact on the accessibility of properly-permissioned shares.
• NTFS permissions must ALSO be configured for this share to be accessible -- not just share permissions!(?) (Despite Share and Storage Management claiming they only apply to local access.)
• The "Everyone" group should not be left out of access permissions even though it explicitly refers to local user accounts, BECAUSE a client computer logged on as the same username as one local to the server will try to authenticate as that user, and be denied if there is a difference in password. (*groan*)

What I don't know:

• Are there any gotchas having to do with cached credentials or server response? Should I reboot my test client workstation after every attempt to connect to the share?
• Should the "Guest" account have anything to do with this, on either the share or NTFS permissions?
• Am I correct in observing the need to configure "ANONYMOUS LOGON" with read permissions on BOTH the share and NTFS permissions? Same for "Everyone" group?

Answer 1

First, setting up anonymous access to a share isn't that bad, you just have to include Anonymous in Everyone (you actually linked to it yourself):

1. Open the Local Group Policy Manager (gpedit)
2. Computer Configuration
3. Windows Settings
4. Security Settings
5. Local Policies
6. Security Options -- Network access: Let Everyone permissions to apply to anonymous users from Disabled to Enabled
7. Change Network access: Restrict anonymous access to Named Pipes and Shares to disabled
8. Network access: Shares that can be accessed anonymously - set the share name there you are sharing.

As far as the Share itself goes then. Set the Share Permissions as "Everyone - Modify" and "Administrators - Full Control". Then set the NTFS permissions as Administrators - Full Control and Everyone - <whatever rights needed>

That should handle your need.

Answer 2

Three things need to be done to set up access for anonymous users under the "Everyone" group, which is cleaner than using 'ANONYMOUS LOGON' explicitly:

1. Create the File Share

• NTFS permissions: set 'Read & Execute', 'List Folder Contents', and 'Read' for the 'Everyone' group
• Share permissions: set 'Read' for the "Everyone" group

2. Adjust Local Security Policy

Open "Local Security Policy", navigate to Security Settings -> Local Policies -> Security Options, and set:

• Network access: Let Everyone permissions apply to anonymous users - Enabled
• Network access: Restrict anonymous access to Named Pipes and Shares - Disabled
• Edit Network access: Shares that can be accessed anonymously to be the name of the share you created. (Formatting is ambiguous, but don't include the server name, and presumedly this is a comma-delimited list if you need more than one.)

3. Allow Access Without a Password

• Open "Advanced sharing settings", either from "Network and Sharing Center" in control panels, or by clicking the link in Properties on the directory (under Password Protection).
• Change the "Password protected sharing" setting to off.

---

Other notes:

• Permissions need to be granted for users BOTH on the NTFS and Share levels
• Consider any testing you do on a machine logged in as a user whose name matches one on your server to be useless (but rebooting a true test machine will not be necessary)

Answer 3

I found this to give me something similar i was looking for. The link below will give anonymous users read only access. No credentials will be required. If you want to add RW access in the step where you add the guest account, just grant full access instead of read only.

http://nikolar.com/2015/03/10/creating-network-share-with-anonymous-access/