Send your Windows question to Mitch today! | See other Windows tips

One of the biggest gripes over the years about file sharing on Microsoft Windows platforms is that users can see files and folders on a network share even if they don't have permission to open those folders or read the files. Since business environments often give files and folders meaningful names like StrategiesForBustingTheUnion or DoNotLetAuditorsSeeThisSpreadsheet.xls or QuickSellYourStockOurCEOisLeaving.doc, this limitation allowed a degree of information leakage that most companies would rather (cough cough) not allow to happen.

The good news is that with Service Pack 1 for Windows Server 2003, a new feature called Access-Based Enumeration (ABE) has been added to how file sharing works on Windows platforms. By installing and enabling ABE on a Windows Server 2003 SP1 or R2 file server, users on Windows XP desktops will only be able to see files and folders if they actually have permission to access them. I recently wrote an article for WindowsNetworking.com that explains how to implement this feature and lists a few gotchas you need to be aware of.

Trouble is, ABE only works if your network shares are on an ABE-enabled Windows Server 2003 SP1 or R2 machine. What if you allow some of the "power users" in your company to share folders on their own Windows XP desktop computers? In that case, you're out of luck as ABE can't be enabled on XP. With Windows Vista however, this has now changed -- Vista has ABE built right into it, and this means that when a user shares a folder on her machine and other users browse that share over the network, they will only see files and folders that they have permissions to access.

Note however that ABE only works if Vista users share their files or folders from within their user profile. Yes that's right, I said files -- in Vista you can share individual files provided you do so from within your user profile. For example, if user Jane Doe shares the file EndOfQuarterPresentation.ppt from within her Documents folder on her computer desk22.mtit.com, then other users to whom she has granted permissions will be able to view and access this file over the network by using the path \\desk22.mtit.com\Users\JaneDoe\Documents\EndOfQuarterPresentation.ppt. All other users on the network however will not even know that Jane's slide deck exists on the network. But if instead Jane creates an explicit SMB share on her machine by creating the folder C:\Presentations and sharing it as Shows, then all users everywhere on the network can know by browsing \\desk22.mtit.com\Shows that Jane will be doing her presentation on the last Friday of the current quarter, though of course only users she has granted permissions to will actually be able to open the slide deck and preview her presentation ahead of time.

ITworld.com

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine