Group Policy help

[furious5]

At the moment we are having alot of problems with users being able to browse the network, and save files in any old directory on the server.

Not ideal, but this is something I have inherited.

I have set up login scripts to map to shares, and this seems to have alleviated the problem somewhat.

But I want to be able to tie the server down so that users cannot simply browse the network and connect to the server root.

Anyone got any ideas of how I can achieve this, is it something group policy could easily acheive?

 

[GiaBetiu]

Fix rhe right rights in the NTFS (or shared level).
By default in Microsoft, fos shares, everyone is added. Remove everyone, and make your own policy who has rights to access, and what.

Gia Betiu
gia@almondeyes.net
Computer Eng. CNE 4, CNE 5, MCSE Win2K
new:

http://www.almondeyes.net

(just started)

 

[furious5]

Erm can you elaborate a bit more, I'm not exactly sure what you are getting at?

 

[micronmega]

When you access a share over the network there are 2 levels of perms you have to go through, share level, and ntfs level. Traversing these perms is restrictive meaning it the share perm is set to full control, and the ntfs perm is set to read, you get read perms.

I would leave the share perms at everyone with full control, and lock down the ntfs side. This will get you some level of control over where users put data.

As far as users browsing the network, you can use GPO to set the computer browser service on all the workstations to manual. That might work for ya.

 

[furious5]

Erm I get the concept, I'm just struggling with the references to sharelevel & ntfs level.

Are you referring to the sharing and security of the shared folder, accessed through the properties?

 

[micronmega]

yes they are accessed through the properties of the folder.

 

[furious5]

Any ideas where to set the computer browser service in the GPO?

 

[micronmega]

Look in Computer Config, Windows settings, security settings, systems services. Just make sure this group policy is only applied to users computers, not your servers. Use group memberships to set that.