Server platforms Toolkit

How to effectively set up file and printer shares

Scott Lowe Tech Republic

Published: 27 Jun 2003 13:42 BST

The cornerstone of a secure infrastructure is the appropriate assignment of permissions for shared folders, file systems, and printers. For administrators setting up a new network or undertaking a migration, planning permissions assignments can be a daunting task, and the consequences of missing something in the process can be disastrous for network security. To help you make sure you touch all the bases, I've put together a step-by-step checklist you can download for free. Here's a look at the issues involved in the assignment process.

Start with physical security
Since the assignment of permissions is primarily an IT security issue, it should come as no surprise that the first step in deploying a protected file/print server involves a fundamental security measure: You need to keep the server hardware under lock and key, and keep it logged off at all times unless there are administrative tasks to perform. Do not leave the server out where anyone can simply sit down at a desk and work at it. If you do, you provide the opportunity for an attacker to bypass much of the permissions structure you're about to put in place.

Assign permissions to groups
Whenever possible, assign permissions to groups rather than to individual users. It's likely that each user in your organisation will have rights to multiple folders, shares, printers, etc. Once you provide these permissions via the user's group membership, if the user leaves the organisation, you can grant his or her replacement identical rights simply by assigning the person to the same groups. It's also much easier to make permission changes to a group rather than to each individual user.

Permission categories
Windows-based servers make use of three main categories of permissions:

Share permissions: A share under Windows is any location that you've enabled users to access by setting options in the Sharing tab in a folder's Properties window. A share can be considered a virtual folder on the server that contains all of the files and folders under the location you've selected.

NTFS permissions: NTFS permissions limit which physical files and folders are accessible on the server after the user has obtained access through the share. NTFS permissions are more granular than share permissions and are available only on partitions that are formatted with the NTFS file system. You access NTFS permission in the Security tab of a folder's Properties window. (If the Security tab doesn't exist, the partition is not NTFS formatted.) These are also the permissions in force if a user logs in at the server console, which needs to be limited to administrators.

Printer permissions: Printer permissions are separate from share and NTFS permissions and identify which users have access to specific printing resources. We won't focus on printer permissions in this article.

Initially, the difference between share and NTFS permissions can create confusion, and figuring out how to troubleshoot permission problems can be tricky if you don't understand the differences. An analogy may help you distinguish between the two. Consider share permissions to be the swipe card that you use to enter your company's building, and NTFS permissions to be the keys you use to unlock the doors to the individual offices.