Re: Allowing file share browsing for un-authenticated users

On 27 May, 06:00, Nonapept...@xxxxxxxxx wrote:
On May 26, 11:30 pm, "jameshanle...@xxxxxxxxxxx"
<snip>
I only know Win XP though for file sharing.

Okay. It seems that if I simply enable the guest account on my Server
2003 machine I am then able to list file shares using an account on a
workgroup computer that does not have an identical counterpart on the
server. That's a step in the right direction, but not quite what I had
in mind.


In Win XP, I would say it sounds like you are set to SFS

When I look through the server's event logs, it looks like the first
access attempt is using the workstation's local username and password.
When that is unsuccessful, it immediately retries using "Guest" (this
is behaviour that I was heretofore unaware of). That access request is
successful when the guest account is enabled.



Where are these logs.. Do they exist in Windows XP?

I have never seen that behaviour. From my Win XP use, it sounds like a
mixture of AFS and SFS. I think that's impossible.. I have never
heard of that. Are you sure?
Is this retry a second later?

I haven't seen the logs though.. would be interested to know where
they are accessible.



There are a number of things that puzzle me about this whole thing
though. The "Network Access: sharing and security model for local
accounts" seems to be irrelevant in this scenario. That policy simply
states that in Classic mode if you access the server using a local
account then your permissions will be granular; allowing one account
the ability to have different permissions than another account. In
Guest Only mode, no matter what account you put in, it will map your
account to whatever permissions the Guest account has been given. That
may or may not included anonymous logins. I haven't figured that out
yet. Either way, I have the server in Client mode and enabling the
Guest account still allows me to enumerate file shares so that Network
Access policy can't be the solution.


you say you "have the server in client mode"? That is absolute
nonsense. Like saying you have the dart board acting as an arrow.

I think you mean Classic.. As in users authenticate as themselves.

I don't know much about NT file permissions. (they are for multi-user
environment of potentially malicious users. I don't need to really for
my own computers at home)

So now I can allow any workgroup machine\user the ability to use the
server's shares, but I have yet to track down the specific policy that
grants this to the guest account. I also have yet to figure out if I
can select individual folders that the guest account can see and use.
That's my ultimate goal.


I mentioned 3 interesting options.
2 of them were "Allow...." and "Deny......"

The default is to Allow everyone, and Deny Guest.
(deny wins..I guess it is processed after)

(so another way of looking at it, is that if you don't deny guest,
ten Guest is allowed. So there is no policy that allows Guest, it's
allowed if it is not denied. So in a sense, that is a default setting
- an unchangeable one. Stupid way of looking at it though. Or maybe
it's the Allowing everyone, that allows Guest.)
Default is Deny Guest.

Although I mentioned that in the context of being relevant to SFS. I
suppose it is relevant to AFS too.

Infact, windows xp machines are set to AFS by default. Guest Account
disabled. Guest Denied. (judging by my win xp installation from the
win xp sp2 cd I burned anyway)

On a related note:

I've mentioned several times that I wondered how client OSs like XP
and Vista share their folders with anyone on the local network by
default. That's still unanswered.

Out of interest.. Where did you see the terminology of calling XP a
client OS?

I know.. I have seen it too.. and it's common. But just wondering
where you saw it..
I actually saw that kind of terminology in a book called Networking
Complete, described windows 98 as a client OS.. Because relative to
Windows NT(the Network OS), its network features were limited.. e.g.
just basic password access to network directories. .

I think the default is AFS.

I think
Win XP only has 2 options . SFS or AFS, and no way of opting out.
But you can choose not to share any folders.

Certainly, I remember that Guest is disabled and Denied. I guess
Network Access is - Classic - users authenticate as themselves.

People who want SFS will have a problem if they just check the box.
They should either run the "Network Setup Wizard". Or after setting
SFS..
Check that it does Allow Everyone (it probably is)
-remove Guest from the deny list -

And check that authentication is as Guest - though it would be if it
is set to SFS.
As explained.

It doesn't seem to be through the
guest account, as its disabled and the user rights assignment "Deny
access to this computer from the network" includes the Guest account.
Yet, anonymous access seems to be unlikely as well since several of
the Network Access policies dealing with Anonymous accounts look like
they stymie anon access.


What is an anonymous account?

BTW, I think with SFS users ONLY authenticate as Guest.
So whoever they are. I don't hink it's like , they try to
authenticate as themselves and if it fails they do so as Guest. They
just do so as Guest.

Your logs claim otherwise.. be interesting to know where these logs
are..

and if they are in Win XP. 'cos I have win xp.

.

Relevant Pages

  • Re: Workgroup Networking Issues with 2 XP MCE
    ... Dell) to fully acess each other's files. ... I was able to access and map HP network drives on Dell, ... password to the guest account, but username is not changeable to login with a ... Type this line at a command prompt to enable the Guest account for ...
    (microsoft.public.windowsxp.network_web)
  • Re: Unable to browse MCE PC?
    ... The Guest Account setting there has ... With Simple File Sharing enabled, all users who request access over ... That's why the Guest account MUST be ... enabled for network access when Simple File Sharing is enabled. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Problem: No Network Connections using Guest Account
    ... BTW...went and signed your guest book on your site... ... Problem I'm experiencing is that the guest account does not show any of the ... be able to add this nextwork connection to my guest account. ... when I log onto the Guest account and look under Network Connections ...
    (microsoft.public.windowsxp.network_web)
  • Re: mobile 6 cant access shares
    ... The event viewer on the server though shows a successful login. ... We had no problems accessing the folder with the Mobile running the PC ... SBS showed a user Guest as being connected. ... So i enabled guest and gave the Guest account full control to the folder ...
    (microsoft.public.pocketpc.phone_edition)
  • Re: mobile 6 cant access shares
    ... The event viewer on the server though shows a successful login. ... had no problems accessing the folder with the Mobile running the PC 2003. ... SBS showed a user Guest as being connected. ... So i enabled guest and gave the Guest account full control to the folder ...
    (microsoft.public.pocketpc.phone_edition)