Security

Ask something
Discussion Locked

Resources access problem.

0 helpful
5 replies

by myteinfo

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

All NT server 4.0 with SP 6a and all NT workstation 4.0 with sp4 or sp6a
RAS server runs on BDC using MS VPN with PPTP.

My small network uses profile.man control all
domain users access to network resources. In the past, The NETLOGON folder hasbeen shared without "$". In the past is ok because no user can see it and open because their profile control them. But now, things have been change. My users working from home and use VPN connect to my network. When they
logon same as in office building, their profile do not download to the computer at home. Now they can browse the network neighborhood to open the NETLOGON folder and its content. We have some folder also share without "$" on all workstation.

My questions:

1. How can I block the users to open up the
NETLOGON folder. If I just change the "everyone" to read permission only, will my action cause logon problem because this is very sensavitive folder. I don't want to log everybody out.

2. Is there a way to blockaccess to other workstation share folder without going in to each computer?

Thanks for any suggestions.

5 replies

by sergey kovzik

errr... why do you hide netlogon? there should be nothing beside logon scripts and policies, what is so confidential in them? and by default you should have everyone read-only access to this share, so nobody will be able to change here information.regarding blocking access - it is possible. but only if you have rights to do this :) you can use server manager and connect to other PC or try "Zero Administration Kit" from microsoft. Windows 2000 has domain wide policies, I don't remember if NT4 had similar thing to manage computers. there are also many 3rd party tools.

by myteinfo

Can I just change the NETLOGON folder
to read permission to veryone user. Will my action cause problem. I am worry if I touch that folder will cause problem that nobody can log in the domain.

I do not why the NETLOGON has been set
for full control for everyone before I work for this company.

Thanks

by sergey kovzik

yes. if there is nothing special in your login scripts or in software you using that needs writing to this directory. but this is really strange if it will need. for your case - do as it done in Windows 2000. They added full Administrator rights to this share in addition to Everyones read-only. If you will even meet problem you will be able to login as Administrator and change permissions back.

Sincerely, Sergey
Brainbench MVP for Win98 Administration

This discussion is closed to new replies.