NTFS security conclusion–file sharing and Permissions

You’ve just shared your My Music folder on your personal desktop, you try to open it from your laptop, and you see ”Access Denied”. You are told to “contact the administrator.” Life just gets better and better.

So what do you do? Turn Simple File Sharing back on?

Tip of the day: Share what you want to share by understanding (and using) Permissions. In yesterday’s article I pointed out that Simple File Sharing “shares” (makes available) everything with everyone, and suggested to you that you should turn it off for better data security. I then showed you how to open a folder’s (or file’s) Properties and ’share’ it manually, which allows you specific control over each ‘resource’ on your network. When everything goes as it should, that is all you need to do and you have easy access to your ’shared’ files. Sometimes things don’t go as we think they should [surprise!] and the reason usually is we’ve bumped into built-in Windows folder permissions which are denying us as an “unauthorized user”. Let’s take another look at the Sharing tab of my My Music folder.

The options available here offer a clue as to what is happening: you can make your folders “private”, which as you may guess is very restrictive; you can “share” (as shown) which is somewhat restricted (it is essentially “read only”); or, you can open things up and also “allow change” (this adds the “write” permission). But to really do what most of us want to do with our ’shares’ (full access and full control), Windows wants us to drag them into the Shared Documents folder — even though the poorly worded description doesn’t sound like that’s what will happen.
The My Documents folder (and all of its subfolders — such as My Music) is “private” (the most restricted) by default…and here is where the problems occurs. This can get real confusing, real quick!

Windows XP’s NTFS has 5 “levels” of permission settings that it assigns to folders. If you are the type who would like a detailed technical explaination, you can read the Microsoft Knowledge article here.

To resolve Access Denied errors, you can troubleshoot the permissions in the “parent” folders (those ‘above’ the file/folder you’re trying to share), or you can use the workaround. The workaround is simple — just create a new folder for sharing. Right-click on a blank area of your desktop and select “New” and then “folder”. Give the new folder a name like ‘Sharing’. Now right-click on it and select Sharing and Security, and click on the Sharing tab. Now place a check (select) in both the “share this folder” and “allow changes” checkboxes.

Because this new folder has not “inherited” any restrictions, you will be able to fully access any of its contents from your networked computers. Now you can use the Move to, or the Copy to, (or, drag-and-drop) tools to fill your new ’share’ with those items you want to have available.

If you continue to have access troubles that these methods do not resolve, you can always turn Simple File Sharing back on, though I don’t recommend it, or consult a friendly tech support type–like myself (Aplus Computer Aid) for instance.

Today’s free link: If you haven’t already peeked into your neighbor’s backyard (from space) using Google Earth, or otherwise explored our planet with the wonder of satellite images yet, give yourself a treat and do so. Download the GE Viewer and then type in the name or address of the spot you want to see, and Google Earth will ‘fly’ you there. Very cool.

Copyright © 2007 Tech Paul. All rights reserved.