From: nobody@nowhere.co.uk   
      
   Java Jive wrote:   
   > Appended below are the instructions I've posted previously to other   
   > Windows newsgroups for sharing folders across PCs.  They are correct for   
   > Windows 7, and almost correct, slight changes only, for all of Windows   
   > 2000 through to 11.   
      
   With apologies for the top post:   
      
   Snip the bit about identical SIDs   
      
   What follows is really good.  I've tried to write something similar   
   myself but yours is much better.   
      
   Please could you re-post it here every few weeks so everybody can find   
   it.  Alternatively do you have a website that you could publish it on?   
   Thanks.   
      
   --   
   Graham J   
      
      
   > Windows Sharing Instructions   
   > ============================   
   >   
   > IMO, M$'s default sharing arrangements have always been dangerously   
   > insecure.  What follows is the comparatively secure   
   > way that I've always set up sharing, ever since Windows 2000.   
   >   
   > Note: These are W7 instructions only, other versions of Windows will   
   > obviously be similar but not exactly the same, because of M$'   
   > pointless and idiotic habit of hiding all the control levers in   
   > different places with every new edition of Windows, thus forcing   
   > people continually to relearn everything they've known for years. (Can   
   > you imagine the catastrophic chaos that would result on the roads if   
   > car manufacturers decided to do that?).   
   >   
   > In what follows, I assume that you want to create shares on each PC   
   > visible to others, and that none are work PCs authenticating to a domain   
   > controller server.   
   >   
   > On each PC:   
   >   
   > 1)    Go into ...   
   >      Control Panel, All Control Panel Items,System,   
   >      Advanced system settings, Computer Name, Change   
   > ... and ensure that name and workgroup are changed to something   
   > memorable from the defaults, and that the latter is the same for all   
   > the machines that you wish to share files together.   
   >   
   > 2)    Any user wishing to access a share on a PC must have a user   
   > account on that PC, so set up the necessary accounts up on each PC,   
   > giving them the same logon user id and passwd as they normally use on   
   > their own PC.  (If on a particular PC you want a user only to be able   
   > to access a share, but not be able to sign on to it, you still need   
   > his/her account to exist, but then it must be added to a block list in   
   > that PC's security policy  -  however, this may not be possible on   
   > some lower cost editions of Windows, and is beyond the scope of these   
   > notes).   
   >   
   > 3)    Go into ...   
   >      Control Panel, All Control Panel Items,   
   >      Network and Sharing Center, Advanced sharing settings   
   > ... and set the following:   
   >      Network discovery   
   >          Probably on, unless reason otherwise;   
   >      File and printer sharing   
   >          Probably on, unless reason otherwise;   
   >      Public folder sharing   
   >          Probably off, unless reason otherwise;   
   >      Media streaming   
   >          Probably off, unless reason otherwise;   
   >      File sharing connections   
   >          Use 128-bit, unless reason otherwise;   
   >      Password protected sharing   
   >          Turn on;   
   >      HomeGroup connections   
   >          Use user accounts and passwords.   
   >   
   > 4)    On each directory or drive of each machine that you want to   
   > share, creating subdirectories for this as required ...   
   >          , Share with,   
   >              Advanced sharing, Advanced sharing;   
   >          Select Share this folder;   
   >          Type a suitable share name   
   >              (Note:  ending it with a '$' will hide it from   
   >              users casually browsing from other Windows PCs,   
   >              but Linux users may still see it via Samba);   
   >          Type a suitable comment, if required;   
   >          Click Permissions, remove the relatively insecure   
   >          default permissions offered, and then click ...   
   >              Add, Advanced, Find Now   
   >          ... and by ing and ing select and add   
   >          the following:   
   >              Admininstrators   
   >              System   
   >              Authenticated Users   
   >          ... and then give them the following permissions ...   
   >              Admininstrators        Full Control   
   >              System            Full Control   
   >              Authenticated Users    Read or Read/Change   
   >                              as required   
   >   
   > 5)    If necessary, but DO NOT DO THE FOLLOWING ON THE WINDOWS FOLDER OR   
   > OTHER SYSTEM FOLDERS (hopefully you're not trying to share these anyway,   
   > not normally recommended) including user folders but sub-directories of   
   > the latter that you've created especially to share are perfectly safe ...   
   >   
   >  the drive or directory being shared   
   > and select ...   
   >          Properties   
   >          Security   
   > ... and ensure the above permissions are replicated on the drive or   
   > folder itself.   
   >   
   > Notes:   
   >   
   > To prevent a particular account from logging on to a particular PC  -   
   > if, say, you want a child to be able to log on to a share on your PC so   
   > the child must have his user account credentials existing on the PC, but   
   > you don't want the child actually logging on to the PC itself  -  then   
   > you must be running a version of Windows that allows access to the   
   > Security Policy management console (from memory, Home versions do not,   
   > and note that I haven't needed to do this in quite a while, so I can't   
   > guarantee these instructions, but IMS they're correct):   
   >    1  Get a Run dialog, say by    
   >    2  secpol.msc    
   >    3  Security Settings, Local Policies, User Rights Assignment   
   >    4  Add particular username to 'Deny logon locally' list, Ok   
   >         (by default this has only 'Guest')   
   >   
   > To prevent logging on using an M$ account, again you need to get into   
   > the Security Policy management console:   
   >    1  Get a Run dialog, say by    
   >    2  secpol.msc    
   >    3  Security Settings, Local Policies, Security Options   
   >    4  Click 'Accounts: Block Microsoft accounts'   
   >    5  Select from the drop-down list ...   
   >         'Users can’t add or log on with Microsoft accounts'   
   >       ... Ok   
   >   
   > To allow XP and earlier to connect to more recent versions of Windows   
      
   [continued in next message]   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)