From: nobody@nowhere.co.uk   
      
   The Horny Goat wrote:   
      
   [snip   
      
   > I've got the same situation - my daughter lives with me and she has   
   > both her own desktop and her employer's laptop (which she mostly uses   
   > when working from home). I can see them on our network (mostly   
   > maintained to share our router and printer connection) but can't see   
   > any drive content of course.   
      
   For explicit and very detailed instructions see the post by Java Jive of   
   10/12/2025, 20:12 in this newsgroup, or in alt.comp.os.windows-10   
      
   I repeat the relevant part below my signature.   
      
   --   
   Graham J   
      
   Windows Sharing Instructions   
   ============================   
      
   IMO, M$'s default sharing arrangements have always been dangerously   
   insecure.  What follows is the comparatively secure   
   way that I've always set up sharing, ever since Windows 2000.   
      
   Note: These are W7 instructions only, other versions of Windows will   
   obviously be similar but not exactly the same, because of M$'   
   pointless and idiotic habit of hiding all the control levers in   
   different places with every new edition of Windows, thus forcing   
   people continually to relearn everything they've known for years. (Can   
   you imagine the catastrophic chaos that would result on the roads if   
   car manufacturers decided to do that?).   
      
   In what follows, I assume that you want to create shares on each PC   
   visible to others, and that none are work PCs authenticating to a domain   
   controller server.   
      
   On each PC:   
      
   1)    Go into ...   
        Control Panel, All Control Panel Items,System,   
        Advanced system settings, Computer Name, Change   
   ... and ensure that name and workgroup are changed to something   
   memorable from the defaults, and that the latter is the same for all   
   the machines that you wish to share files together.   
      
   2)    Any user wishing to access a share on a PC must have a user   
   account on that PC, so set up the necessary accounts up on each PC,   
   giving them the same logon user id and passwd as they normally use on   
   their own PC.  (If on a particular PC you want a user only to be able   
   to access a share, but not be able to sign on to it, you still need   
   his/her account to exist, but then it must be added to a block list in   
   that PC's security policy  -  however, this may not be possible on   
   some lower cost editions of Windows, and is beyond the scope of these   
   notes).   
      
   3)    Go into ...   
        Control Panel, All Control Panel Items,   
        Network and Sharing Center, Advanced sharing settings   
   ... and set the following:   
        Network discovery   
            Probably on, unless reason otherwise;   
        File and printer sharing   
            Probably on, unless reason otherwise;   
        Public folder sharing   
            Probably off, unless reason otherwise;   
        Media streaming   
            Probably off, unless reason otherwise;   
        File sharing connections   
            Use 128-bit, unless reason otherwise;   
        Password protected sharing   
            Turn on;   
        HomeGroup connections   
            Use user accounts and passwords.   
      
   4)    On each directory or drive of each machine that you want to   
   share, creating subdirectories for this as required ...   
            , Share with,   
                Advanced sharing, Advanced sharing;   
            Select Share this folder;   
            Type a suitable share name   
                (Note:  ending it with a '$' will hide it from   
                users casually browsing from other Windows PCs,   
                but Linux users may still see it via Samba);   
            Type a suitable comment, if required;   
            Click Permissions, remove the relatively insecure   
            default permissions offered, and then click ...   
                Add, Advanced, Find Now   
            ... and by ing and ing select and add   
            the following:   
                Admininstrators   
                System   
                Authenticated Users   
            ... and then give them the following permissions ...   
                Admininstrators        Full Control   
                System            Full Control   
                Authenticated Users    Read or Read/Change   
                                as required   
      
   5)    If necessary, but DO NOT DO THE FOLLOWING ON THE WINDOWS FOLDER OR   
   OTHER SYSTEM FOLDERS (hopefully you're not trying to share these anyway,   
   not normally recommended) including user folders but sub-directories of   
   the latter that you've created especially to share are perfectly safe ...   
      
    the drive or directory being shared   
   and select ...   
            Properties   
            Security   
   ... and ensure the above permissions are replicated on the drive or   
   folder itself.   
      
   Notes:   
      
   To prevent a particular account from logging on to a particular PC  -   
   if, say, you want a child to be able to log on to a share on your PC so   
   the child must have his user account credentials existing on the PC, but   
   you don't want the child actually logging on to the PC itself  -  then   
   you must be running a version of Windows that allows access to the   
   Security Policy management console (from memory, Home versions do not,   
   and note that I haven't needed to do this in quite a while, so I can't   
   guarantee these instructions, but IMS they're correct):   
      1  Get a Run dialog, say by    
      2  secpol.msc    
      3  Security Settings, Local Policies, User Rights Assignment   
      4  Add particular username to 'Deny logon locally' list, Ok   
           (by default this has only 'Guest')   
      
   To prevent logging on using an M$ account, again you need to get into   
   the Security Policy management console:   
      1  Get a Run dialog, say by    
      2  secpol.msc    
      3  Security Settings, Local Policies, Security Options   
      4  Click 'Accounts: Block Microsoft accounts'   
      5  Select from the drop-down list ...   
           'Users can’t add or log on with Microsoft accounts'   
         ... Ok   
      
   To allow XP and earlier to connect to more recent versions of Windows   
   such as 10, or those between which are running Microsoft Security   
   Essentials, you have to enable SMBv1.  To do this ...   
      
   Windows 10+: Run Powershell as Admin and enter the following:   
      Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol   
      
   Windows 7-:  SMBv1 is enabled by default, so normally no change is   
   needed, however, ISTR that installing Microsoft Security Essentials   
   disables it, in which case you have to set or make a registry change to   
   enable it, as follows:   
      
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters   
      
   Registry entry: SMB1   
   REG_DWORD: 0 = Disabled   
   REG_DWORD: 1 = Enabled   
   Default: 1 = Enabled (No registry key is created)   
      
      
   [continued in next message]   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)