Filesharing

[secutanudu]

Hello,

In active directory, is there a way to enable filesharing on local pc's but not allow users to share files or folders? We would like the sharing only for administrative shares (c$, d$, etc), and some VBScripts that I am trying to run require filesharing be turned on.

Is there a way in group policy or elsewhere to prevent users from actually sharing files or folders? I seem to remember somehwere in group policy where you can specify which security group has access to a certain machine....or maybe there's a better place to do it...

We use winXP pc's with windows 2000 server active directory.

Thanks, Andrew

 

[bcastner]

You certainly can use Local Policy, User Rights Assignment, "Allow access to this computer from the network" to restrict the Groups/users that could access any created share or automatic administrative share.

If there is no access it matters little if a share is created.

 

[Enkrypted]

There is also the option in XP to turn off the Simple File Sharing, which will give you more control over file share access on folders and files. That option is in Tools->Folder Options->Then uncheck option for Enable Simple File Sharing.

Enkrypted
A+

 

[secutanudu]

Yeah I suppose if nobody can access the share it won't do the users much good, nor will it violate any security policies.

So if i just added the domain users and the everyone group to that policy entry, that should likely take care of it....thanks.

Andrew

 

[bcastner]

Well, sort of.
If you are adding entries, add them to "Deny access to this computer from the network" instead.

 

[secutanudu]

Oh i didn't notice that you put "allow" - the only entry i see in group policy is "deny access to this computer from the network" - where is the allow one?

 

[bcastner]

My typing error. "Access this computer from the network."
We ended up in the same place.

Apologies.
Bill Castner

 

[secutanudu]

Oh there it is - great. So I can just leave the only group in there as "administrators" and that would include all domain admins as well - thats perfect. Thanks.

Andrew

PS - How do you find the time to answer so many questions???

 

[bcastner]

Remember that Domain Administrators are not by default members of the local Administrators group. You would have to add them if not already there.

http://support.microsoft.com/?kbid=297307