How can I get Windows Server 2012 R2 to stop asking for a file share password?

Question

We have one folder on a Windows Server 2012 R2 that we want to share without passwords. I've tried everything I can find, but no matter what I try, the server prompts for a password on the share and won't let me in. The server and the users of the share are in the same domain.

• The share itself has only these permissions: 'Everyone' full control, and 'ANONYMOUS LOGON' full control.

• The NTFS folder has these permissions added: 'Everyone' full control, and 'ANONYMOUS LOGON' full control.

• There's no 'Turn off password protected sharing' option in the Network and Sharing Center. I don't really want to turn off password protected sharing anyway, in case a need arises for a password protected share.

• I tried this answer. It didn't work. I also don't want to enable a guest account.

Is there a policy hack I don't know about? What else is there?

Answer 1

I'm assuming, since you say the server is prompting for passwords and because the server is in a domain that the users in question are not part of the domain.

If the users are part of the domain, look at the NTFS file permissions inside the share and make sure that everyone you want to have access does, in fact, have access. You have to set the permissions at both the file/NTFS level and the share level.

If you want users who aren't part of the domain to access the share without passwords, "Guest" is the account users connect as if they don't have an account on the server. To quote MSDN:

People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. The Guest account does not require a password.

You can set rights and permissions for the Guest account just like any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to log on to a domain. The Guest account is disabled by default, and we recommend that it stay disabled.

In other words, if the users are not a part of the domain, your statements "We have one folder on a Windows Server 2012 R2 that we want to share without passwords" and "I also don't want to enable a guest account" are mutually exclusive.

Answer 2

I know this is an old question and you probably have a work-around by now but for the benefit of any "searchers" that come across this...

There is a third level of access control on Windows servers going back many versions that is controlled by policy. Start the Local Security Policy manager by running secpol.msc and check "Local Policy\User Rights Assignment\Access this computer from the network". For your purposes, you would need to add Everyone (if you want anonymous access), or Authenticated Users/Domain Users (if all your users have domain accounts common with the target file server).

You should research this right carefully to ensure you are not compromising security on other services on the file server because the right is for the whole server (not just one share) and encompasses more than just file access - it applies to most if not all network services.

Additional things to check:

• Network Access Right is controlled by policy so it might be set for your server at a domain level in a Group Policy Object (GPO).
• Look into Traverse Checking; it is normally disabled for performance reasons but if enabled a user not only needs access rights to the target folders but every parent folder to the top of the share.
• Failing everything else, I would attempt connection with the Firewall disabled temporarily. Although it is not a common practice, modern Windows firewall rules can include user, group, and computer filters. If temporarily disabling the firewall permits the access you are looking for, you will need to examine the firewall rules (particularly "File and Print Sharing" rules) for any modifications that may restrict your user access.

Good Luck