Re: Help With Permissions onWork Group Network

From: Roger Abell [MVP] (mvpNOSPAM@asu.edu)
Date: 02/08/03


From: "Roger Abell [MVP]" <mvpNOSPAM@asu.edu>
Date: Fri, 7 Feb 2003 23:47:45 -0700


"Peter Harrington" <peter.harrington@ohio.edu> wrote in message news:OwYTuSfzCHA.2552@TK2MSFTNGP12...
> Hi:
>
> We have a work group of 10 computers all running Windows XP Pro on a
> university WAN. On each computer we have about 10 users. I would like to
> share folders with my workgroup memembers without making them accessible to
> the entire WAN.
>
> We have simple file sharing turned off.
>
Good - this will simplify your sharing,
and in fact is required if you want to
selectively share this to them and that to
those others.

> The problem is that I do not want to create user accounts for all users on
> all local machines.
>
No choice. Outside of a domain this is required.
 
> Is there a way to add a group of users with remote accounts to the
> permission list?
No

> Is there a permission for a workgroup?
>
No

> As a last resort:
>
> If I must create accounts for all users on my machine so that individual
> permissions exist, can I disable them from the Login screen, so they may
> have permission to share without being able to login to the computer and
> without the account appearing in the welcome window?
>
Yes.
There is a pair of policies
Deny local logon
and
Logon locally
If an account is not grant the right to log on locally
then it cannot. It will however need the right to
Access the computer over the network.
You can control visibility in the logon Welcome
screen with TweakUI, or registry edit at
 
 HKLM\SOFTWARE\Microsoft\Windows
 NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

With a value of 0 it will not show.

> TIA,
>
> Pete
>
>

You will simplify your task greatly by first thinking about
your sharing model, and then designing it so that you can
minimize the total number of shares and of machine from
which things are shared.

-- 
Roger Abell
MS MVP (Security, Windows), MCDBA,  MCSE both
Associate Expert - Windows XP ExpertZone
http://www.microsoft.com/windowsxp/expertzone


Relevant Pages

  • Help With Permissions onWork Group Network
    ... We have a work group of 10 computers all running Windows XP Pro on a ... university WAN. ... The problem is that I do not want to create user accounts for all users on ... Is there a permission for a workgroup? ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Establish WHO can use WHAT application
    ... add a new group Group1 with Read/Execute permission to the ... 1st directory in Program Files, add a new group Group2 with Read/Execute ... permission to the 2nd directory in Program Files, ... and all subfolders/files for at least one of the Admin accounts (e.g. ...
    (microsoft.public.windowsxp.security_admin)
  • RE: New users cannot access some parts of internal website
    ... permission on the folders where the data is at and everyone has the same ... I understand that the new accounts cannot ... Uninstall Internet Explorer Enhanced Security by unchecking the same. ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Establish WHO can use WHAT application
    ... would really make More sense that these accounts be moved to the Power ... add a new group Group1 with Read/Execute permission to the ... > with Read/Execute permission to the 3rd directory in Program Files, ... > Administrators but be very very careful here ...
    (microsoft.public.windowsxp.security_admin)
  • RE: New users cannot access some parts of internal website
    ... I understand that the new accounts cannot ... Uninstall Internet Explorer Enhanced Security by unchecking the same. ... Microsoft CSS Online Newsgroup Support ... | don't have permission to access the internet). ...
    (microsoft.public.windows.server.sbs)