Access-based Enumeration question.

[TomLet]

Hello all,

Is anybody using Access-based Enumeration? I installed it but cannot seem to get it working correctly. How are the permissions supposed to be set in share & security? I set share for user(full control) and removed everyone completely and set security to user(full control) and removed everyone anfter shutting off inheritable permissions for the folder and it is still visible on the network to other users. Any ideas.

Thank you,

Tom

 

[TomLet]

Bump - anyone? Any ideas?

 

[xmsre]

This might help

http://support.microsoft.com/default.aspx?scid=kb;en-us;907458

 

[Daveyd123]

I am using ABE. Works great for me. It goes by the ACL on the folders (NTFS permissions)

 

[TomLet]

So you do a root share and set the NTFS ACL on the sub-folders? Do you have to change the share permissions? What should the NTFS permissions on the share be? I just can't seem to get this working.

Thanks,

Tom

 

[Daveyd123]

on your logical drive..say D: create a shared folder. Give the shared folder Authenticated Users (Create) share permissions...or whatever you want. Set the NTFS permisions on that folder to Domain Users (read&execute, read and list)

In the shared folder create several folders. Give each folder different NTFS permissions. EX: Folder1 (Finance:Modify); Folder2(MIS:Modify); Folder3(HR:Modify)

Right Click the folder that is shared and enable ABE.

Users in the Finance group should only be able to see Folder1; users in the MIS group should only see Folder2 and so on

 

[TomLet]

OK, I set up the permissions. On the share in share permissions I have Authenticated Users (change&read) in the NTFS permissions I have Domain Users (read&execute, read and list) and Administrators (full control). On the sub-folders I have Administrators (full control) and the user (full control). When I navigate to the share as any user (and no, my regular users are not members of the Administrators group )you can still see all of the folders. The ACL's are working in that although any user can see the folders they cannot get into them (access denied). I just need to figure out what I'm doing wrong.

There are two shares on the folder one I created long ago to hide the user shares from the network (users$) and one I created that is visible (users) for getting this to work. If I can get this to work I'll phase out the use of the hidden share.

Thanks,

Tom

 

[Daveyd123]

Im not sure if ABE works per user account as I ahve never tried it that way.

Take the user off the ACL list for that folder and add that user to a Group (other than admins)

Create 2 folders in your share.

On Folder1 add the Group that you just put the user in to the ACL and give that Group the default rights

On Folder2 do no add that Group to the ACL.

If you log in as that user, you should only see Folder1

 

[TomLet]

Hello all,

Well it work, and with user level security ! It turns out the account I was testing it with had elevated permissions. I checked with other accounts and all is well. Thanks to everyone that responded!

Tom