Re: Help With Permissions onWork Group Network

From: Roger Abell [MVP] (
Date: 02/08/03

From: "Roger Abell [MVP]" <>
Date: Fri, 7 Feb 2003 23:47:45 -0700

"Peter Harrington" <> wrote in message news:OwYTuSfzCHA.2552@TK2MSFTNGP12...
> Hi:
> We have a work group of 10 computers all running Windows XP Pro on a
> university WAN. On each computer we have about 10 users. I would like to
> share folders with my workgroup memembers without making them accessible to
> the entire WAN.
> We have simple file sharing turned off.
Good - this will simplify your sharing,
and in fact is required if you want to
selectively share this to them and that to
those others.

> The problem is that I do not want to create user accounts for all users on
> all local machines.
No choice. Outside of a domain this is required.
> Is there a way to add a group of users with remote accounts to the
> permission list?

> Is there a permission for a workgroup?

> As a last resort:
> If I must create accounts for all users on my machine so that individual
> permissions exist, can I disable them from the Login screen, so they may
> have permission to share without being able to login to the computer and
> without the account appearing in the welcome window?
There is a pair of policies
Deny local logon
Logon locally
If an account is not grant the right to log on locally
then it cannot. It will however need the right to
Access the computer over the network.
You can control visibility in the logon Welcome
screen with TweakUI, or registry edit at

With a value of 0 it will not show.

> TIA,
> Pete

You will simplify your task greatly by first thinking about
your sharing model, and then designing it so that you can
minimize the total number of shares and of machine from
which things are shared.

Roger Abell
MS MVP (Security, Windows), MCDBA,  MCSE both
Associate Expert - Windows XP ExpertZone