Home / server / Questions / 29907
Accepted
Michael Kelley
Asked: 2009-06-23 10:33:00 +0800 CST

Windows Server 2003 Shared File Permissions

  • 772

I have a folder on my Windows Server 2003 that I'd like to share with all computers on the network, but I want to force people to input a password (at least initially) to connect to the share. I tried adding a password to the "Guest" account, but it never asks for a password. I've tried setting up a separate account with a password, but I get "Windows cannot access \server\" message. What's the best way to accomplish what I'm trying to do?

windows-server-2003 network-share

3 Answers

  1. Best Answer

    (I am assuming you are doing this with a standalone server and clients that aren't members of a domain.)

    • Disable the "Guest" account on the server.

    • After you've done that, create an account on the server computer with the username / password that you want users to use.

    • Set the "Share Permissions" on the shared folder to "Everyone / Full Control" (assuming that you're sharing folders on an NTFS volume). There's no reason to use "Share Permissions" if the underlying filesystem is NTFS-- it will just complicate things. (If I could somehow influence Microsoft to do anything I'd have them remove this functionality.)

    • Modify the NTFS permission on the shared folder to allow the user you created above to have the type of access you require (Read, Full-Control, etc). (Don't name "Everyone" unless you mean "Everyone in the world".)

    • Finally, when you "connect" from the client computer and are prompted for credentials, be sure you enter the credential as "SERVERNAME\Username".

    • The behavior of Windows Explorer, in my experience, has been spotty. I'd try the following from a command-prompt on client computer just to be sure:

      NET USE * \servername\sharename /USER:severname\username password

    If that works, but Windows Explorer isn't prompting for credentials, you probably have credentials saved by Explorer that need to be cleared.

    The "Guest" account's enabled / disabled status is interpreted by the OS as a "flag" that says "Allow unauthenticated users to connect..." versus "Do not allow authenticated users to connect..." (I am glossing over some details here, but this is basically true.)

    • 2

  2. We would set the share permissions to Authenticated Users full and set proper NTFS permissions on the folders being accessed. Authenticated Users not Everyone. D'oh!

    • 1

  3. You need to make sure that the Everyone groups does not have permission on the share, because the Everyone groups really does include everyone, even unauthenticated users. Instead give permission to a specific user or group to force authentication to the folder.

    • 0