File and Print Sharing Question... 1

[stclsquid]

Hi,

I am needing to turn on file and print sharing for an SMS implimentation and I would like to only allow administrator the ability to create shares for security reasons. Is it possible through the policy editor or a registry key?

 

[bcastner]

If these are shares on the SMS server, then only the administrator is able to create them.

 

[stclsquid]

The shares are on each client machine.

 

[bcastner]

In that case the best answer is no, there is not a GPO. But you can do this with NTFS permissions.

 

[stclsquid]

I am not sure how to do that, can you please explain?

Thanks a bunch
Chris

 

[bcastner]

Two thoughts:

. only a user with Ownership NTFS rights can create a share. Use the reskit XCALCS.EXE to remove "ownership" to their local drives;

. you can deny registry permissions to modify a critical key that stores the Share information. Work backwards from this MS KB:

http://support.microsoft.com/?kbid=125996

A user without the ability to modify this key will not be able to add a share.