Windows Forum

Ask something
Discussion Locked

Denying access to folders

0 helpful
10 replies

by james_randy 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have a network with 3 NT servers and 25 Win95 clients. One of my servers has a second hard drive which is a shared device accessible to everyone on the network. I would like to isolate a particular folder that resides deep in the directory structure, and deny access to that particular folder to everyone EXCEPT a few users. I would prefer to password protect it rather than allow use to specified "log-in" users since all client computers are really available to anyone. (I wouldn't want a "denied" user to be able to go to the computer of an "approved" user to gain access.) This is probably an easy question for NT experts, but a tough one for me. Anyone willing to share their expertise in this area? Thanks in advance.

10 replies

by mark.tassin

You have a real security issue my friend. Setting security on that folder from the NT server to limit it to particular users is the approved methodology for security. If you wish to prevent a user from going to another users machine and hi-jackinghis or her account, make it a requirement that a user log off when they leave their machines, or put passwords on their screensavers.

by syscokid

What's in the folder? MS Office documents/ They can be password-protected from within the software. Then just share the password with the chosen few.

by fred_e944

NT shared folder access is based on Group memberships and permissions; there is no provision for password-protecting a share as such, but an attempt to access the share checks whether the logged-on user had permission to access the folder based on the Access Token returned to the user by NetLogon when they logged in to the network.

Standard NT procedure for protecting folder(all completed on server).
1) Open User Manager for Domains and create a Global Group. Add ONLY the persons needingacess to the folder to this group.
2) Create a Local Group and ad the Global Group to the Local Group (it should be the only member, other than Admins).
3) Open Windows Explorer and right-click on the folder. Select Sharing|Permissions and add the name of the Local Group. Remove the Everyone Group(only after adding another group). If you have NTFS file system you can also use the NTFS Permissions to control access.

This will not stop others from accessing files if someone else with permissions has left

by arwjnplanotx

One possibility:
Make the folder hidden, create a group which has access to that folder and add the authorized users to that group. They will have to know and type in the path to access the drive so it's kind of like a password. Users who are not in the group will not have access under their own login and should not be made privy to the path name.

Maybe this will sparc other ideas,

Al

by ryank

This assumes that disk's partition is formated using NTFS, otherwise this is not possible. To convert to NTFS without loosing any data use the convert.exe command at the command line and reboot if prompted to.

The syntax of the command would be as follow if say the drive was d:

convert d: /fs:ntfs

Share the folder seperately. On the local machine create a username/account that you want people to use to access this folder.

Setup the share then at that folder then. In the "share" permissions allow only that username access with full control.

Next then, in the file system not being accessed from that share right click on the folder in question and properties and then goto the security tab. Click the permissions button (thisis the NTFS "file" permissions). Assign only the user(s) you want to have access change permissions to this and allow the administrators group full control (this will allow users to read/write/delete files but not take ownership).

This should dowhat you need it to.

This discussion is closed to new replies.