To create shares on a server running Windows Server 2003, you must be a member of the Administrators or Server Operators group. You can create shares using Windows Explorer, Computer Management, or NET SHARE from the command line.
Windows Explorer works well when you want to share folders on the computer to which you are logged on.
Using Computer Management, you can share the folders on the local computer and on any computer to which you can connect.
Using NET SHARE, you can create shares from the command line or in scripts. Type net share /? at the command prompt for details on using this command.
As an administrator, Computer Management is the tool you'll use the most for creating and managing shares. After you create a share, you might want to publish it in Active Directory so it is easier to find.
By using Windows Explorer, you can share folders on the computer to which you are logged on. In Windows Explorer, right-click the folder you want to share, and select Sharing And Security. This displays the folder's Properties dialog box with the Sharing tab selected. Select Share This Folder, as shown in Figure 20-6.
In the Share Name field, type a name for the share. This is the name of the folder to which users will connect. The key thing to keep in mind when naming shares is that the names must be unique for each system. Share names can be up to 80 characters in length and can contain spaces. If you want to provide support for MS-DOS clients, you should limit the share name to eight characters with a three-letter extension and no spaces. Optionally, type a description of the share in the Description field. The description is displayed as comments when you view shares in My Network Places and other Windows dialog boxes.
Tip
Create hidden shares to hide the share from view
If you want to hide the share from users (which means that they won't be able to see the shared resource when they try to browse to it in Windows Explorer or at the command line), type $ as the last character of the share name. Keep in mind that you can hide shares only from normal users. If users have Administrator privileges, they would be able to get a list of the shares.
Click Permissions to view and set the share permissions as discussed in the section entitled "Managing Share Permissions" later in this chapter. Share permissions provide the top-level access controls to the share. By default, all users have Read access to the share, but they don't have other permissions. This is an important security change for Windows Server 2003 that is designed to help ensure permissions aren't given to users unless you grant them.
Note
After you set share permissions, you might want to configure the share for offline use. By default, the share is configured so that only files and programs that users specify are available for offline use. If you want to prohibit the offline use of files or programs in the share or specify that all files and programs in the share are available for offline use, click Change, and then select the appropriate options in the Offline Settings dialog box.
Finally, click OK to create the share, and it is immediately available for use. In Windows Explorer, you'll see that the folder icon now includes a hand to indicate it is a share. If you access the folder's Sharing tab again, you'll see a new button at the bottom of the tab labeled New Share. This button lets you share the folder again using a different name and a different set of access permissions.
If you create multiple shares, the Share Name box of the Sharing tab becomes a selection list that allows you to select a share to work with and configure, as shown in Figure 21-7. Once you've selected a share to work with, the options in the Sharing tab apply to that share only. You'll also have a Remove Share option, which you can use to remove the additional share.
By using Computer Management, you can share the folders of any computer to which you can connect on the network. This is handy for when you are sitting at your desk and don't want to have to log on locally to share a server's folders. After you start Computer Management, you can connect to the computer you want to work with by right-clicking Computer Management in the console tree and then selecting Connect To Another Computer. Use the Select Computer dialog box to choose the computer you want to work with. When you are finished, expand System Tools and Shared Folders, and then select Shares to display the current shares on the system you are working with.
You can then create a shared folder by right-clicking Shares and then selecting New Share. This starts the Share A Folder Wizard. Click Next to display the Folder Path page as shown in Figure 21-8. In the Folder Path field, type the full path to the folder you want to share. If you don't know the full path, click Browse, and then use the Browse For Folder dialog box to find the folder you want to share. The Browse For Folder dialog box will also let you create a new folder that you can then share. Click Next when you are ready to continue.
In the Share Name field, type a name for the share, as shown in Figure 21-9. This is the name of the folder to which users will connect, and it must be unique on the computer you are working with. Share names can be up to 80 characters in length and can contain spaces. If you want to provide support for MS-DOS clients, you should limit the share name to eight characters with a three-letter extension. If you want to hide the share from users (which means that they won't be able to see the shared resource when they try to browse to it in Windows Explorer or at the command line), type $ as the last character of the share name.
Optionally, type a description of the share in the Description field. The description is displayed as comments when you view shares in My Network Places and other Windows dialog boxes.
When File Sharing For Macintosh is installed, the options on this wizard page change considerably, as shown in Figure 21-10. Here, you can do the following:
Enable or disable the shared folder for usage by Microsoft Windows Users. The Microsoft Windows Users option is selected by default. If you clear Microsoft Windows Users, the folder will be configured for use only by Apple Macintosh Users.
Enable or disable the shared folder for usage by Apple Macintosh Users. The Apple Macintosh Users option isn't selected by default. If you select Apple Macintosh Users, the folder will be configured for use by Apple Macintosh Users. You can then either accept the default share name (which is set the same as the Windows share name if applicable) or type a new share name.
When you are ready to continue, click Next to display the Permissions page shown in Figure 21-11. The available options are as follows:
All Users Have Read-Only Access This is the default option. When you create shared folders in Windows Explorer, this permission is set automatically to give users the right to view files and read data but to restrict them from creating, modifying, or deleting files and folders.
Note
Granting Read access instead of Full Control by default is an important security change for Windows Server 2003. It is designed to help ensure permissions aren't given to users unless you specifically grant them. Although it is a start on better controls, it isn't perfect because this permission is assigned to the special group Everyone, which means anyone with access to the network—even Guests—have Read access to the share.
Administrators Have Full Access; Other Users Have Read-Only Access This option gives administrators full access to the share. This allows administrators to create, modify, and delete files and folders. On NTFS it also gives administrators the right to change permissions and to take ownership of files and folders. Other users can only view files and read data. They can't create, modify, or delete files and folders.
Administrators Have Full Access; Other Users Have Read And Write Access This option gives administrators full access to the share and allows other users to create, modify, or delete files and folders.
Use Custom Share And Folder Permissions This option allows you to configure access for specific users and groups, which is usually the best technique to use. Setting share permissions is discussed fully later in this chapter in the section entitled "Managing Share Permissions."
After you set up permissions on the share, click Finish. The wizard displays a status report, which should state "Sharing Was Successful" as shown in Figure 21-12. Click Close.
Sometimes, you'll also want to publish shares in Active Directory to make them easier to find. The quickest way to do this is to use Computer Management. After you start computer management and connect to the computer you want to work with, expand System Tools And Shared Folders, and then select Shares to display the current shares on the system you are working with.
You can then publish a shared folder by right-clicking the share in the details pane and then selecting Properties. In the share's Properties dialog box, select the Publish tab as shown in Figure 21-13. Finally, select Publish This Share In Active Directory, and then click OK.
