<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Prevent users from seeing objects they cannot access with Access Based Enumeration ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-310460/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-22T18:58:07-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[Access-Based Enumeration]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3724952]]></link>
        <description><![CDATA[It works fine when the folder is mapped, it does not show the folders with No Read permissions for a particular user. But when the same user makes RDC to that server it gets to view the folder name. Of course he is not able the access the folder as he gets access denied message but he does gets to see the folder names. I don't want the users to see the folder names. Folder to which they don't access Read access should be hidden from them even when they RDC to that server.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3724952]]></guid>
        <dc:creator><![CDATA[Atul_R]]></dc:creator>
        <pubDate>Wed, 12 Dec 2012 22:51:47 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[RE: Prevent users from seeing objects they cannot access with Access Based Enumeration]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3093009]]></link>
        <description><![CDATA[Well, it is about time. I had this feature on my Novell network over 10 years ago.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3093009]]></guid>
        <dc:creator><![CDATA[gijoemarine@...]]></dc:creator>
        <pubDate>Thu, 11 Jun 2009 09:45:05 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Not working with Win 2003 SP2?!]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3092328]]></link>
        <description><![CDATA[We us it for our file-server, it's great! Everybody gets a mapped drive to the same place, but they only see what they have access to. Way less confusing for the end users. The only very frustrating part is it only works with SP1, it doesn't work with SP2! Or is there a newer version available? Maybe can make a copy from the Win2008 disk which will work with Win2003 SP2?!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3092328]]></guid>
        <dc:creator><![CDATA[Hagstrom]]></dc:creator>
        <pubDate>Wed, 10 Jun 2009 12:30:20 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Been around for years (since 2005)]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3090468]]></link>
        <description><![CDATA[nothing new, used it on W2003.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3090468]]></guid>
        <dc:creator><![CDATA[The 'G-Man.']]></dc:creator>
        <pubDate>Mon, 08 Jun 2009 07:29:23 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[You did miss something...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3090428]]></link>
        <description><![CDATA[Much MS documentation gives you the impression that ABE works exclusively on shares. It doesn't. It works on folders that are usually accessed using shares. You switch it on by accessing the properties of a folder that is shared. I'm guessing if a user logged on locally that an ABE-protected folder would not be displayed if listed locally.Imagine a share named users$ that has individual subfolders for each user. If the user browsed to user$, without application of ABE he'd see a long list of everyone's home folders. With ABE he'd see just one, his own, the only one that he has at least &quot;list&quot; permission to.So ABE enhances your practice as in your 2nd para above, by &quot;hiding&quot; folders your users cannot access.ABE tweaks the way NTFS attributes are used to display folders in explorer and dialogs. It does not tweak the way shares work, although I grant you it may also hide shares if the perms on the actual share don't allow list/read, I've never tried that as using the &quot;$&quot; suffix is usually enough.See the MS doc at http://www.microsoft.com/windowsserver2003/techinfo/overview/abe.mspxRS]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3090428]]></guid>
        <dc:creator><![CDATA[bulk@...]]></dc:creator>
        <pubDate>Mon, 08 Jun 2009 06:49:22 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Coming from Novell]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3090135]]></link>
        <description><![CDATA[I come from a MS background and have always understood the &quot;I see it but when I click on it, I get Access Denied&quot; issue. Hell, we have put a folder out there named &quot;Secret&quot; and audited attempts to open it just for fun. However, the company I work at currently has been a Novell shop for ever. We have recently been sold and the new company has in the words of our CIO, &quot;drank the Microsoft kool-aid.&quot; I hear constantly about how &quot;Novell could do this&quot; and &quot;Novell could do that&quot; from the old admins that are resisting the change. The biggest complaint from the legacy Novell admins and management alike has been that people can see folders that they could not before. They simply do not like the concept. Management is a skittish bunch and yes we do have to save them from themselves sometimes but this doesn't seem so bad to me. It sits on top of existing security, it doesn't replace it. It gives the typical end user (we are in the south)a simpler view. I was not even aware this existed for 2003. I may test it out on one of our low priority file servers tomorrow. Just to silence the Novell lovers. If simply hiding a file takes out your file server then one of two scenarios has occurred. The first is that it was such a well orchestrated attack that there was not much you could have done to stop it. The second scenario is that you are a crappy admin that has not done their job. This may sound a little Darwinian but in this case, you need to get creamed. Your company will come back stronger for it or the market will simply cull the herd. If the company comes back maybe you will come back as a better admin for having been burned... or there will be an opening for someone else. In this market, that wouldn't be too hard to fill. The guy that delivered my pizza the other day had an MCSE and a CCNP. I chatted with him a bit and I don't think he was a &quot;paper MCSE&quot; either. Just my 2 cents.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3090135]]></guid>
        <dc:creator><![CDATA[Esher72]]></dc:creator>
        <pubDate>Sun, 07 Jun 2009 18:23:48 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Take care if using ABE with DFS]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3090051]]></link>
        <description><![CDATA[If you combine ABE with DFS, you should consult KB 907458, &quot;How to implement Windows Server 2003 Access-based Enumeration in a DFS environment&quot; otherwise ABE may not work as you expect.RS]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3090051]]></guid>
        <dc:creator><![CDATA[bulk@...]]></dc:creator>
        <pubDate>Sun, 07 Jun 2009 11:49:54 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Hide complexity from users]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3088408]]></link>
        <description><![CDATA[I see this as a way to hide complexity from users that don't need to see it.  I have found that if a user only can see the directories that they use then it makes them a lot happier.Bill]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3088408]]></guid>
        <dc:creator><![CDATA[wdewey@...]]></dc:creator>
        <pubDate>Thu, 04 Jun 2009 10:21:49 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[its a great utility I used in server 2003]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087969]]></link>
        <description><![CDATA[Its a great utility i have used this utility in server 2003 abeui.msi on the file server, it comes handy when you don't want others to let other users to see what data is there created by other users on the file server]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087969]]></guid>
        <dc:creator><![CDATA[atuldeshmukh@...]]></dc:creator>
        <pubDate>Wed, 03 Jun 2009 22:04:00 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[security by obscurity concept]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087824]]></link>
        <description><![CDATA[All this is doing is adding security by obscurity you still set your permissions as usual. I can see why people say it's useless but I can also see a benefit (if it isn't there people are less tempted to try and explore it.Obviously if there is someone malicious accessing the network either internally or externally the benefit of this is lessened.As for hidden malware as stated above if you?re the administrator you are able to see all files/folders.It just complements your security]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087824]]></guid>
        <dc:creator><![CDATA[Nimmo]]></dc:creator>
        <pubDate>Wed, 03 Jun 2009 16:24:13 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Why hide files when you should be restricting them]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087584]]></link>
        <description><![CDATA[Anyone who is trying to compromise your systems know that mmc regedit exist.  Rather than simply trying to hide them and potentially breaking future update (since your are changing the security permissions), you should use Group Policies to prevent any access to them.Block registry access: http://www.mydigitallife.info/2008/12/23/how-to-disable-registry-editor-editing-tool-regedit/Block MMC and snap ins: http://technet.microsoft.com/en-us/library/cc722167(WS.10).aspxThis will also allow you to set this policy more easily on multiple computers almost immediately (within the group policy interval time) and will prevent you from either manually going to each computer and changing the permissions or manually scripting the permissions changes.  Also, this will prevent breaking any updates in the future.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087584]]></guid>
        <dc:creator><![CDATA[Aakash Shah]]></dc:creator>
        <pubDate>Wed, 03 Jun 2009 10:27:22 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[if you remove the tab characters before compiling with watcom objects shut]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087552]]></link>
        <description><![CDATA[if you remove the tab character before compiling with watcom the objects shut down properly in the exectronic journal]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087552]]></guid>
        <dc:creator><![CDATA[waltrutka@...]]></dc:creator>
        <pubDate>Wed, 03 Jun 2009 10:02:52 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[May not completely work...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087512]]></link>
        <description><![CDATA[Unless I missed something ABE works only if you are specifically setting security on the share iyself and not just the folder. By default Windows Server 2003 assigns the &quot;everyone&quot; group with &quot;read&quot; access on the share.Although not a perfect practice [and against Microsoft's certification requirements], we remove &quot;everyone&quot; and then add &quot;authenticated users&quot; giving that group full access on the share. We then use file and folder permissions to apply the security we want for the folder [and below].]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087512]]></guid>
        <dc:creator><![CDATA[Gis Bun]]></dc:creator>
        <pubDate>Wed, 03 Jun 2009 09:25:53 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Huh?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087510]]></link>
        <description><![CDATA[I guess you don't get the concept. This hides folders for those who don't have PERMISSIONS to the share. As an administrator you should have access to everything.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087510]]></guid>
        <dc:creator><![CDATA[Gis Bun]]></dc:creator>
        <pubDate>Wed, 03 Jun 2009 09:20:59 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[That's right, give crackers something else they can use]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087469]]></link>
        <description><![CDATA[that's right.. so now the cracker just has to remove the read option from files and folders to hide them from an adminstrator login.. gee thanks.. I really need another &quot;I_love_you.txt.com&quot; virus or other hidden content that the cracker can place there, and the administrator can't see.. as if root kits weren't enough.Why doesn't microsoft learn from their mistakes?  I can see this as a great thing for admins to block the average idiot ... but again, it only gives another tool to the BAD people out there.. just like with the &quot;I love you&quot; virus.. you would have thought after that massively well known infection, that microsoft would have STOPPED defaulting to hidden files, folders, and extensions..not enough good comes from hiding files and folders, and too much bad can come from it.. let your users question that folder they see.. if they can't open it..they can't open it.. that's a pretty f**king simple concept for a user to learn.. why try to color every window rose colored only to make the idiots unaware?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087469]]></guid>
        <dc:creator><![CDATA[TG2]]></dc:creator>
        <pubDate>Wed, 03 Jun 2009 08:28:14 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Hide files you don't want people to see]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087321]]></link>
        <description><![CDATA[Hi Derek, my problem with Vista and I assume Win 7 is that I cannot totally restrict user access to files that they do have read access to.  Files like MMC.EXE and REGEDT32.EXE.  Yes I know the Party Line that they really can't do an major damage because they have limited use of the files but we don't want them to even know that they exist.  With XP I can easily remove their access rights to almost all files but with Vista I have to take ownership of the files.  At that point I have probably taken at least some of the access away from the &quot;Trusted Installer&quot; phantom user.  No one seems to know what damage that will do in the future.  Why did they take those important rights away from administrators?  No one at M$ will even talk to me about this issue.Ted McCarty]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-310460-3087321]]></guid>
        <dc:creator><![CDATA[ted.mccarty@...]]></dc:creator>
        <pubDate>Wed, 03 Jun 2009 06:38:41 -0700</pubDate>
    </item>
    </channel>
</rss>

