Managing Share Permissions

As discussed previously, Windows Server 2003 has two levels of permissions for shared folders: share permissions and file and folder permissions. Share permissions are applied any time you access a file or folder over the network. These top-level permissions set the maximum allowable actions available within a shared folder. Although share permissions can get you in the door when you work remotely, the file and folder permissions can further constrain access and the allowable actions.

When accessing files locally, only the file and folder permissions are applied. However, when accessing files remotely, first the share permissions are applied and then the file and folder permissions. In the case of file allocation table (FAT) volumes, the share permissions are the only permissions, and if a user has local access to the folder, the user can perform any action.

Understanding Share Permissions

With shared folders, you use share permissions to set the maximum allowed access level. Share permissions are applied only when you access a folder remotely, and they can be used to grant access directly to users or implicitly through the groups to which users belong.

The share permissions available are as follows:

  • Full Control By granting this permission, users have Read and Change permissions, as well as the following additional capabilities to change file and folder permissions and take ownership of files and folders.

  • Change By granting this permission, users have Read permissions and the additional capability to create files and subfolders, modify files, change attributes on files and subfolders, and delete files and subfolders.

  • Read By granting this permission, you allow users to view file and subfolder names, access the subfolders of the share, read file data and attributes, and run program files.

If you have Read permissions on a share, the most you can do is perform read operations. If you have Change permissions on a share, the most you can do is perform read operations and change operations. If you have Full Control, you have full access. However, in any case, file and folder permissions can further constrain access.

Permissions assigned to groups work like this: If a user is a member of a group that is granted share permissions, the user also has those permissions. If a user is a member of multiple groups, the permissions are cumulative. This means that if one group of which the user is a member has Read access and another has additional access, the user has additional access as well.

Inside Out: Changes might be needed to enhance security

Changes might be needed to enhance security

When you create a shared folder, default access permissions are assigned. Watch out, though, because the default in most cases is to give Read access to the special group Everyone, which means that even Guests have access to shares—it doesn't mean they can read files, however, because this is determined by the base-level file and folder permissions. In most cases, it is more prudent to lock down access and only grant permissions to those users that truly need access to a shared folder. If you really want to grant wide access to a shared folder, you might want to use the Domain Users group to do this rather than the Everyone group. In this case, you would remove the Everyone group and add the Domain Users group. By using Domain Users, you require users to have a logon account to access the shared folder, which excludes Guests.

To override this behavior, you must specifically deny an access permission. Denying permission is the trump card—it takes precedence and overrides permissions that have been granted. When you want to single out a user or group and not let it have a permission, configure the share permissions to specifically deny that permission to the user or group. For example, if a user is a member of a group that has been granted Full Control over a share, but the user should have only Change permissions, configure the share to deny Full Control to that user.

Configuring Share Permissions

The easiest way to configure share permissions is to use Computer Management. After you start Computer Management, connect to the computer you want to work with by right-clicking Computer Management in the console tree and then selecting Connect To Another Computer. Then use the Select Computer dialog box to choose the computer you want to work with. When you are finished, expand System Tools And Shared Folders, and then select Shares to display the current shares on the system you are working with.

To view or manage the permissions of a share, right-click the share, and then select Properties. In the share Properties dialog box, select the Share Permissions tab, as shown in Figure 21-14. You can now view the users and groups that have access to the share and the type of access they have.

View or set share permissions.

Figure 21-14. View or set share permissions.

In this example, members of the Domain Admins group have Full Control over the share and members of the Domain Users group have Change access. The group Everyone was removed to enhance security as discussed in the sidebar "Changes Might Be Needed to Enhance Security" earlier in this chapter.

You can grant or deny permission to access a share by following these steps:

  1. In Computer Management, right-click the share, and then select Properties. In the share Properties dialog box, select the Share Permissions tab.

  2. In the Share Permissions tab, choose Add. This opens the Select Users, Computers, Or Groups dialog box, as shown in Figure 21-15.

    Specify the users or groups to add.

    Figure 21-15. Specify the users or groups to add.

  3. The Locations button allows you to access account names from other domains. Click Locations to see a list of the current domains, trusted domains, and other resources that you can access. Because of the transitive trusts in Windows Server 2003, you can usually access all the domains in the domain tree or forest.

  4. Type the name of a user or group account in the selected or default domain, and then click Check Names. The options available depend on the number of matches found, as follows:

    • When a single match is found, the dialog box is automatically updated as appropriate and the entry is underlined.

    • When no matches are found, you've either entered an incorrect name part or you're working with an incorrect location. Modify the name and try again, or click Locations to select a new location.

    • If multiple matches are found, select the name(s) you want to use, and then click OK.

  5. To add additional users or groups, type a semicolon (;), and then repeat this process. 6 When you click OK, the users and groups are added to the Name list for the share.

  6. Configure access permissions for each user and group added by selecting an account name and then allowing or denying access permissions. If a user or group should be granted access permissions, select the permission in the Allow column. If a user or group should be denied access permissions, select the permission in the Deny column.

  7. When you're finished, click OK.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset