Creating permanent share files

[sharyn]

Dball! I added another question to the other post about this

I am now unable to get this working on the latest machine I'm setting up..

Can you please try doing this on your machine..also, check out the latest thread I added to the original post

Thanks!
Sharyn

 

[mhughes]

Do you have guest enabled on the W2K machine?

 

[sharyn]

no..guest is disabled..how would enabling the guest account have anything to do with giving a local user permission to create a share?

I am on an NT domain.

hey..but I"m willing to try anything!

 

[mhughes]

Sorry,I got screwed up with posting responses,Guest was for another thread.

 

[dball63]

I said that I hadn't done this myself so there you go. It was jsut a thought of the top of my head. I do remember reading somewhere that making changes to local security policy will be not do any good if there are domain level security policies too. I'm not sure if that is the case here.
Anybody know if that is what is happening here???

You say it works at times and then doesn't work.

 

[sharyn]

Nope..it's not working at all..never did.

Turns out, in my playing around, my test user got added to the power users group which is why the sharing option was on the right click menu.

When I added the test user to the local policy for creating a permanent share, took the test user out of the power users group and put them back in the regular users group, it didnt work anymore. Putting them in power users is not an option here for me.

So, in a nutshell, the test user is part of the regular users group, with the local policy that allows them to create a permanent share and they still cant do this. I have tested some of the other local policys with this user and they are working so I know the local policies are being applied. I am beginning to think that even though this policy is called create a permanent share file, the way Im using it is not the way it was intended to be used.

Am pretty much at a loss here as to how to proceed..am beginning to think what I want to do just can't be done.

 

[dball63]

I tried myself and was unsuccessful too. Maybe this Create Perm Share Objects isn't what it sounds like. It wouldn't be the first time if you're familiar w/ microsofts boot partition contains system files and the system partition contains the boot files, That one always killed me.

Anyway, I'm sure if you keep thinking about it and maybe getting some more ideas from people here that you can come up with something that will work for you.

I still think your best option is going to be w/ policies. That is where I would look first. Locking down your users, there are a ton of different things to do with policies. One that comes to mind is "Run only allowed programs" This gives you the power to say what exe's users can run. I've never done this because I Imagine it could get quite tideous with people asking to be able to run new programs and I wouldn't want to be burdened with all that. Just a thought.

I'm working on something here myself. I'm getting ready to roll out win 2000 to my users and a few apps require power user status and I really would rather not have my users installing apps on there own. So I'm working on my own little issues too. Right now I have to users testing and they are installing all kinds of shit! Internet, napster, screensavers, I have to stop them soon. I'm still working with software vendors on one application. These things sometime don't come to you overnight. So keep thinking about it. There will eventually be easy solution.

 

[sharyn]

In my researching, fyi, I discovered an obscure article in the MS knowledge base that says that in a mixed mode environment, where one is running win2k pro workstations and NT 4.0 servers, these policies don't alway work the way they should, even though they LOOK like they are working

go figure! Keep me posted on what you're discovering..this all started out because of a problem user who insists on installing all kinds of crap on her box that shouldnt be there.

I have this thread marked to notify me via email when someone has posted a response. Thanks for taking the time to answer me

 

[mssms]

We have domin users and they log on to the domain member w2k pro. workstations.
We have almost same problem. We don't want to give them power user rights over member desktops. At this case they can not be able to share their folders.
I tried to use the same item over group policy but it didn't work.
Any idea?

 

[bcastner]

You should be able to share the "Shared Folder". But in any case:

I. Worst method:

A) On YOUR workstation ... Create an account for the user you wish to share the folders with (START | Programs | Administrative Tools | User Manager)

B) Share the folders (Explorer) AND give the users in "A" above sufficient permissions

The reason this is the "Worst" method, is that you will have to do this with *each* user.

Note: You *cannot* user the default admin shares that Win2k creates automatically. You must create a new sharename with no "$" sign.

II. Best Method:

If you have access to the Primary Domain Controller, log in under an admin account and ...

1) On the Primary Domain Controller: Create a Global Group, say "Windows Worstations" and add all the Windows guys to it with User Manager for Domains.

(Steps 2-4 below are really just one step, but I tried to make it easier to follow)

2) On YOUR workstation, create a LOCAL Group and ADD the Global group (From User Manager, click on USER | Add Local Group)

3) Type in a Name THEN click the ADD button (you should now be in the " Add Users and Groups" Dialog

4) now click on the drop down arrow at the top of the dialog box entitled "List Names From" and select your Primary Domain Controller and add the Global Group from step 1 above.

5) Now goto Explorer and share your Folders (remember: you cannot use the dafault admin shares!) and add the LOCAL group that has the Global group in it in the permissions.

I know this sounds more complex, but in the long run it will be much easier, as all you gotta do now is add a new user to the Global Group on the DC and they will automatically have permissions on your system ... VS. adding a new account on your Workstation each time and then adding the persons to the permissions list in Exlorer.

Adapted from an original newsgroup posting by Bruce Korbin.