-
1
- #1
If you have tried to access shared resources in a workgroup environment, like printers, or file shares from a windows 2000 computer, you may have been confronted with a screen that asks for a password and nothing seems to work. 2000 doesn't share like 98 does. Here's a brief example of how authentication works. computer1 (any windows operating system like 2000, 98, NT) tries to access a resourse on computer2 which is running windows 2000. Supose "Joe" is logged into computer1 with his password "Smith". Computer2 looks to see if it knows "Joe" in its local userbase. If yes, and the passwords match ("Smith"
, then Joe has access to the resources. If the passwords don't match, then computer2 prompts Joe on computer1 for his password on computer2. If Joe doesn't exist on computer2 (no local account there), then computer2 defaults to the Guest account and prompts Joe on computer1 for the password to the guest account. By default, the guest account is not active on computer2, so even if Joe types in the password for the guest (default no password), Joe doesn't get access. To correct the problem, you can do one of two things:
1. Create an account on computer2 for Joe with the password Smith and give Joe share and NTFS permissions to the resources you wish Joe to have. If you give share and NTFS permissions to the everyone group on computer2, Joe will be a part of that since he is part of the everyone group for computer2. Any group that Joe on computer2 is a part of, and given access on computer2, will be accessible when Joe is on computer1. Simply put, computer2 knows who Joe is, knows what groups he belongs to on computer2, and knows who has access to what by user or group membership. Using this method, you will have to create accounts on computer2 for all the users wishing to access resources from other computers with those credentials.
2. Activate the guest account on computer2 and give it share and NTFS permissions to the resources (printers, files) you wish others to have. Just as above, any group that guest belongs to on computer2 that has resources permissions, will also get permissions (like the everyone group). By default, the everyone group gets NTFS permissions to all resources excluding some permissions on system files and individual profile folders, etc. (which is a good thing to leave this way but can be changed to include permissions for everyone). When you create a resource share on computer2 (printer,file) it now works like it does with 98. Give share permissions to everyone and others now have access to it. You can add a password to the guest account if you like. Be warned, however, that you are giving access to everyone on your network or that can connect to it, no matter who they are. That can be really bad but in some ways, this is also a good tool because you don't have to create accounts on computer2 for every new user who needs access to resources through the network. In some small environments like a home or very small business where everyone has access to all the computers, or no confidential information is stored, this is not a problem.
So what about a domain environment? These methods will work in a domain environment. Now you can also share to groups not available in workgroups - domain groups. Users now authenticate themselves to a domain controller and computers that are "joined" to the domain can share resources to domain groups on these computers. The computers that have been joined to the domain will accept the word of the domain controller that a user is authentic and a local account for that user is no longer needed. All the local computer will need to be told is what domain groups or users to share resources to. The domain controller will let the local computer know if the user is in that domain group.
, then Joe has access to the resources. If the passwords don't match, then computer2 prompts Joe on computer1 for his password on computer2. If Joe doesn't exist on computer2 (no local account there), then computer2 defaults to the Guest account and prompts Joe on computer1 for the password to the guest account. By default, the guest account is not active on computer2, so even if Joe types in the password for the guest (default no password), Joe doesn't get access. To correct the problem, you can do one of two things: 1. Create an account on computer2 for Joe with the password Smith and give Joe share and NTFS permissions to the resources you wish Joe to have. If you give share and NTFS permissions to the everyone group on computer2, Joe will be a part of that since he is part of the everyone group for computer2. Any group that Joe on computer2 is a part of, and given access on computer2, will be accessible when Joe is on computer1. Simply put, computer2 knows who Joe is, knows what groups he belongs to on computer2, and knows who has access to what by user or group membership. Using this method, you will have to create accounts on computer2 for all the users wishing to access resources from other computers with those credentials.
2. Activate the guest account on computer2 and give it share and NTFS permissions to the resources (printers, files) you wish others to have. Just as above, any group that guest belongs to on computer2 that has resources permissions, will also get permissions (like the everyone group). By default, the everyone group gets NTFS permissions to all resources excluding some permissions on system files and individual profile folders, etc. (which is a good thing to leave this way but can be changed to include permissions for everyone). When you create a resource share on computer2 (printer,file) it now works like it does with 98. Give share permissions to everyone and others now have access to it. You can add a password to the guest account if you like. Be warned, however, that you are giving access to everyone on your network or that can connect to it, no matter who they are. That can be really bad but in some ways, this is also a good tool because you don't have to create accounts on computer2 for every new user who needs access to resources through the network. In some small environments like a home or very small business where everyone has access to all the computers, or no confidential information is stored, this is not a problem.
So what about a domain environment? These methods will work in a domain environment. Now you can also share to groups not available in workgroups - domain groups. Users now authenticate themselves to a domain controller and computers that are "joined" to the domain can share resources to domain groups on these computers. The computers that have been joined to the domain will accept the word of the domain controller that a user is authentic and a local account for that user is no longer needed. All the local computer will need to be told is what domain groups or users to share resources to. The domain controller will let the local computer know if the user is in that domain group.