Network Sharing w/ XP Pro

[mtbiker]

Hello Everyone,

I have 2 workstations at home and a Laptop which I carry from my office to home. So, the laptop (XP Pro) is actually part of a workgroup at the office (administration) while my home workgroup is (mshome). The two workstations at home are both in the same workgroup (mshome), one is XP Pro, the other is Win2000 pro.

Here's the issue I have. From the XP workstation I would like to share out the Root of one of it's drives as a network share drive. However I do want authentication. So I set up sharing at the root of the directory NOT using simple file sharing, and set permissions at "authenticated Users". On my Win2000pro workstation I have the entire C:drive shared again with authenticated users as permission.

OK, From my laptop I can see and communicate with the Win2000pro box without problem. It asked for user ID and Password, and I was in. From my laptop to my XP Pro box I can see the share in network neighborhood, but when I click, I get a message telling me I don't have rights, see the administrator. But I never even got a pop up box to authenticate.

From my laptop at the office I have no problems with authentication on any of 12 workgroups. But they are all Win2000pro. XP pro laptop to XP pro workstation, just do not seem to work with authentication. If I remove the permission from Authenticated user to Everyone, then my laptop has NO problem getting to the share on the XP box.

I'm missing something here, and I thought someone else must have had this same issue before...

Thanks everyone



.. ..

Bill [:<}

....................................

 

[bcastner]

Yes there is a difference in the authenticated users group. It has to do with the underlying issue that the anonymous logon group is no longer a member of the group Everyone.

See:

http://www.microsoft.com/technet/tr...pro/proddocs/windows_security_differences.asp

 

[mtbiker]

I have also noticed that you cannot disable the 'Guest' user or none of your 'file and print sharing' will work.

I tried to disable the Guest user, then lost my share to the printer.

Thanks for the link. I am trying the 'security' fix option. I do see the Anonymous logon group, but the document doesn't reference if it's supposed to be included as a Security Tab option or as having rights to the share?

Thanks for the info bcastner I knew that their must be a way of minimal security for the shares I have out on these two machines. Leaving them wide open with everyone permissions I cannot see as a very good option. I wonder why Microsoft set it up like this?

Oh well. I'll report on how this works shortly.



.. ..

Bill [:<}

....................................

 

[bcastner]

Do not focus on the anonymous user group, (there are several Group policy settings involved, and it is not worth it).

For XP with 'Simple file sharing' disabled in a Workgroup:

. Spend the time to make sure that for every user:

. they have a password
. that there username and password are entered as valid users on every other Workgroup computer.
. use NTFS for all filestores

Under XP in a Workgroup the default &quot;Groups&quot; for permission purposes are essentially Administrator, and Limited Uers. (&quot;Guest is an odd and special case, that loses most - but not all- meaning if Simple file sharing is disabled). All other &quot;groups&quot; are essentially undefined other than through the default Group Policy settings as local policy.

So you have to do the work in a Workgroup setting: add/subtract share permissions; add/subtract NTFS permissions by drive, folder, file; add/remove ACLs by device, drive, folder, file or registry key; etc.; and adjust Group Policy.

The facilities are there to be as granular as an AD setting, but decidedly a bigger p.i.a. factor is involved; fortunately, in a home LAN setting one rarely needs to be this fancy.

I think you would benefit exploring my &quot;Cool Tool&quot; from a previous 'lightbulb' posting to the forum: thread779-685048

Also, see what the newish Tweakui Powertoy from Microsoft offers in terms of setting basic rights:

http://www.microsoft.com/windowsxp/pro/downloads/powertoys.asp

It would take several pages to explain the root source of your issue. But in a nutshell, &quot;groups&quot;, particularly in a workgroup setting, are not containers for permissions. That is the purpose of Group Policy, share level security, NTFS security, and ACLs. In a workgroup setting there are really only two &quot;groups&quot;: Administrators and limited users, although there are some GUID oddities about 'Guest' as a local account. It is up to you to make the other &quot;groups&quot; mean something with the five tools mentioned above: Local policy, Group Policy, share level security, NTFS rights and registry and other device ACLs.

This is nearly completely under the control of the Administrator. (There are SYSTEM and NETWORK exceptions).

Best,
Bill Castner

 

[mtbiker]

WOW! Bill, I'm definatly feeling kind of overwhelmed here. Seems that Microsoft wouldn't have made this so difficult, but then they did give the offering for the &quot;simple file sharing&quot;.

I guess you miss what you like when things change. My two workstations at home were both Win2000pro, but I recently added a larger second HD to use as my shared drive, so I opted to Upgrade the OS to XP Pro, given the C: drive is basically only the OS and some Microsoft Program Files stuff.

I really don't have a &quot;security&quot; issue so I could just set the share open, or just leave the shared folder that is set by default. No &quot;users&quot; to be concerned with, just my son on his machine that is the Win2000pro box, and my home desktop with XP Pro that I have two users, my and my wife. My laptop is just me, but the workgroup for my home network and the office are different, and as work their are literally 12 other workgroups that I connect to each day. I guess I won't be taking them to XP Pro any time soon.

I checked the Win2000pro box settings for the security and authentication and tried the same on the XP Pro but as you already know, it didn't work.
I'm still working on the security setting from your first reply Bill, but the laptop and the home workstations usually take a few minutes before they linkup and see eachother. Sometimes I force a print job down and it makes the two talk to each other. Funny, because you'de think the two XP pro machines would speak well with eachother, but it's the XP pro and the Win2000pro that have no difficulties even in different workgroups.

Thank You for your reply's, I'm gonna keep at it. As long as it is possible to do, I'll figure out how (usually with some help).

Bill Shaw


.. ..

Bill [:<}

....................................

 

[bcastner]

For all users (no blank or empty passwords) on Computer A, make them users with passwords on Computer B.
For all users on Computer B, make them users with passwords (same) on Computer A.

Set the Share permissions and NTFS permissions to include the Group 'Everyone.'

And, don't argue with it.

Bill Castner

 

[mtbiker]

THANK YOU !!



.. ..

Bill [:<}

....................................