Stopping access to a share

[GoldenWonder]

Not sure if this is even possible but I want to stop users accessing a hidden share by typing the share in Word (i.e \\server\share$) and browsing it.

 

Now, I know I can use permissions to do this, but they need write access to this share (for a program than runs at login) but I don't want them to browse the share and delete files themselves!

 

If they type \\server\share$ into Explorer its blocked, but Word etc doesn't stop them!

[36Degrees]

I assume you have set an advanced permission so that they cannot access "this folder only"?

[GoldenWonder]

That won't really help, as their account needs to have delete/modify rights for the folder that is shared (the delete is done by a program running under their account)

 

Its really to stop them browsing the folder and deleting the files manually

[sister_annex]

does the program have to run under their account??

 

Mark

[GoldenWonder]

Unfortunately yes, unless I can find a way of making VB6 connect to a \\share using other credentials!

[sister_annex]

ah,

 

I know you can run processes as other users in .net but i dont know vb6 that well

[GoldenWonder]

Yeah it looks like a re-write of the code, or finding another way altogether.

 

Its a catch 22 situation, they need write access, but I want to stop write access

[sister_annex]

What is it you are looking to re-write - or more plainly what does the program do?

[p858snake]

Not sure if this is even possible but I want to stop users accessing a hidden share by typing the share in Word (i.e \\server\share$) and browsing it.

 

Now, I know I can use permissions to do this, but they need write access to this share (for a program than runs at login) but I don't want them to browse the share and delete files themselves!

 

If they type \\server\share$ into Explorer its blocked, but Word etc doesn't stop them!

 

Using NTFS permissions:

Add the group you want to restrict -> and Deny "Read", "List folder contents", "Read and Execute".

 

Basically this means, the user will still be able to create in it, but the moment they do create it will disappear from view nor will they be able to open anything in it.

 

If the files aren't getting over-ridden by the script, you may also be able to remove "modify".

Edited March 25, 2010 by p858snake

[sister_annex]

Using NTFS permissions:

Add the group you want to restrict -> and Deny "Read", "List folder contents", "Read and Execute".

 

Basically this means, the user will still be able to create in it, but the moment they do create it will disappear from view nor will they be able to open anything in it.

 

If the files aren't getting over-ridden by the script, you may also be able to remove "modify".

 

I completley forgot about doing it that way... whoops

[36Degrees]

That won't really help, as their account needs to have delete/modify rights for the folder that is shared (the delete is done by a program running under their account)

 

Its really to stop them browsing the folder and deleting the files manually

 

We have a folder on a share that has scripts in - the folder has access permission for "subfolders and files only" meaning that they can use the scripts inside but not open the folder they are in.

[GoldenWonder]

Sorry, I should also mention that the program reads a file in there first, then writes or deletes depending on the outcome.

 

Turning off rights to browse the folder stops the program from opening the file in the first instance.

[36Degrees]

Sorry, I should also mention that the program reads a file in there first, then writes or deletes depending on the outcome.

 

That should be where the "subfolders and files only" permission comes in.

 

Is the folder path visible to the students? I was about to suggest something then realised it wouldn't change anything if that path was now visible.

Edited March 25, 2010 by 36Degrees

[GoldenWonder]

I think I've got this working now thanks to everyones help.

 

When I set the permissions to deny browsing the top folder (this folder only) but allow modify/delete etc to Subfolders and Files, the program cannot delete the file. Presumably because VB6 'browses' the folder to delete it. It can still open,edit and save though!

 

If I set the program to read/write into a subfolder from the main folder using the same permissions as above then this works. Not exactly as I'd expect but it must also be something to do with the way VB6 deletes files.

 

Cheers for the help on this one!

[glennda]

I think you can do it via group policy and deny browsing to UNC paths in windows explorer - im just trying to find the setting

 

Toby

[GoldenWonder]

I think removing the Run command in GP prevents this. But if you type a share path into Word and make it a hyperlink (i.e \\server\share) this still works.