Looking for a Windows based solution.


  1. A standalone WS 2012R2 located on NETWORK A is sharing a folder with R/W access through a local user.
  2. A segregated NETWORK B contains user PCs, some joined to NETWORK B’s WS 2019 AD, others configured as standalone.
  3. NETWORKS A and B are connected via a firewall/router appliance.


  1. Make the share on the 2012R2 server in NETWORK A available as READ-ONLY to user PCs on NETWORK B.
  2. Both domain-joined and standalone user PCs on NETWORK B need to have access to the share.
  3. Guarantee that users’ access is READ-ONLY.
  4. Users need to be able to launch applications directly from the READ-ONLY share/mapped drive.


  1. No changes can be made to the Windows 2012R2 server.
  2. Users should not be able to bypass the RO control and map the share as RW.


Basically we need to either re-share the WS 2012R2 share inside NETWORK B but this time as READ-ONLY, or somehow configure user PCs to map the RW share RO. However, since some user PCs are not domain-joined, we can’t simply let them “see” the external share (requirement 3).

Temporary solution:

A Linux machine CIFS-mounts the WS2012R2 share and exports it as RO using samba. This works, but introduces another platform which is not desirable. Also, it is somewhat slower than a true Windows solution, and reparse points get “lost”.

Attempted so far:

  1. SMB sharing the SMB share
  2. mklink /d the share and then exporting the link
  3. SUBST command
  4. Various chains of the above 3
  5. DFS namespaces
  6. FTP sharing the SMB share (does not work well as a true map)
  7. NFS sharing the SMB share (windows keeps dereferencing all the way to the network path, resulting in failure)
  8. Share between a Hyper-V host and a VM
  9. Building SAMBA on Windows. Got quite far, but still unable to complete the build. Even if it builds, not hopeful that it will work correctly on Windows (unsupported)
  10. Proxying the requests via a router. No luck so far.
  • I am still trying the DFS namespace option in different configurations, but these all seem to be providing symbolic links to the source drive, thus I am unable to control permissions from Network B. – Brent May 23 '19 at 22:05

The logical way to do it is as your Windows 2012R2 as it's in a workgroup, I would create another local user locally onto that server that is RO. but that break that;


No changes can be made to the Windows 2012R2 server.

Another solution is using another server and sync with DFS, but that 2012R2 would need to be domain joined to have it work. You state it break your rule #3, but it's not true, as you can put the security into the share for both users, one read only and the other RW, that part work, and your PC in a workgroups can have a manually mapped drive using the correct user account to map it.

| improve this answer | |
  • Thank you, but we can't create another user because we cannot modify the 2012R2 server. Also, DFS replication requires domain membership and here again we cannot modify the 2012R2. – Brent May 23 '19 at 19:00
  1. Ensure Network B PCs have no network access to the current 2012 R2 file server (appropriate firewall rule or switch ACL)
  2. Setup a robocopy job from the 2012 R2 file server to a new file server (with the /MIR option)
  3. Create a RO share on the new file server from which a read-only copy of the data can be.
| improve this answer | |
  • Thank you, 1. Yes we have the ACL set. 2,3. Because of the volume of files on this drive robocopy is not a viable solution. The drive has 10's of millions of files, and a large number are changes throughout the day by the number of users working. The copy would get stale and not usable too often. – Brent May 23 '19 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.