Hide files in NETLOGON but still allow execution

[aker]

Hi. Server: Windows NT 4.0 SP6a. Clients: Windows 3.11/9x.

In the NETLOGON directory (%WINDIR%\System32\Repl\Import\Scripts) I have some basic but necessary logon batch files which, for example, set DOS environment variables.

Anybody can simply enter \\SERVER_NAME\NETLOGON more-or-less anywhere and be faced with all the files in the directory. As I have a personal batch per user, it is an easy way (for hackers ) to see a list of users in the domain. From here they can open the batch files in NotePad and read all the information contained within.

I have experimented with Special File Access and Special Directory Access and Share Permissions but have had no luck in stopping access to execute but not list.

Thanks in advance.

 

[jtb]

System Policy Editor...

http://www.webtube.co.uk/Support/using_system_policy_editor.htm

http://www.geocities.com/~budallen/poledit.html

http://service.gateway.com/gateway/series/1,,9+53+26120+25424,00.html

and dozens more... see your favorite search engine for more...

I definitely recommend the O'reilly book

http://www.oreilly.de/catalog/winsyspe/

JTB
Solutions Architect
MCSE-NT4, MCP+I, MCP-W2K, CCNA, CCDA,
CTE, MCIWD, i-Net+, Network+
(MCSA, MCSE-W2K, MCIWA, SCSA, SCNA in progress)

 

[aker]

jtb- thanks for the suggestion. I am familiar with the system policy editor, but can't find anything about not letting people see files in a shared (read only) directory.
Maybe you could be a tad more specific.
Regards.

 

[globalstrata]

When you say hackers do you think someone inside the company or outside. Because if it is someone outside, you could give permission to Authenticated Users or Domain Users\Administrator and that will take care of most of the problems (Also, it is always good to have a firewall). If inside, then I would try:

Give permissions to each file for only that user and the Administrators.
Gladys Rodriguez
GlobalStrata Solutions

http://www.globalstrata.com

 

[aker]

globalstrata- my question was a general 'how do you' with the intention of hiding files from users but still letting their machines run the specified files. I don't even want the designated user to see his/her logon script, let alone anybody else see a list of the users in the domain.
With regards to hacking, it was both internal and external. I don't trust users or firewalls and am not sure to what extent an external hacker can access the server once he/she gets though the firewall, for example, will he/she be able to see/access the shared directories or is that only possible on LANs?
Regards.

 

[captnstiles]

Go to Winnt\system32\repl\import\ this is where you should fing your login script. Right click the batch file or script and give it "read only,archive and hidden permission. This stops users from browsing network neighborhood to find the login script. Depending if you are running it in the foreground or background will determine if your users see the command prompt window with the script running.

 

[djhawthorn]

In regards to external hackers, you can set permissions (either share and/or NTFS) to allow only "Authenticated Users" to access the directory. That way you'd need to log on before you can actually look in the directory.

As for hiding the files, I don't think it's possible. As captnstiles suggests, you can turn on the "hidden" attribute, but anyone who has set their PC to "Show all files/folders" will display those hidden files anyway. MCSE NT4/W2K

 

[jtb]

System Policy Editor clues...

1. Make hidden files invisible to normal users...

2. Don't let them change it...

3. Make NETLOGON contents hidden...

4. Make security policy that states penalties for circumenting, bypassing, reengineering, or otherwise tampering with the system policies a capital offense, i.e., punishable with death of some privilege...

5. If you know who the culprits are already, suggest to them that use of the organizations computers is not a God-given right and they are in danger of losing access...

JTB
Solutions Architect
MCSE-NT4, MCP+I, MCP-W2K, CCNA, CCDA,
CTE, MCIWD, i-Net+, Network+
(MCSA, MCSE-W2K, MCIWA, SCSA, SCNA in progress)