Connecting to printer always asks for username/password..

[Aloke Prasad]

I have XPPro running on the main PC (the one I use with an attached
printer that I share with 2 other PC's. The other PC's run XP Home and Win
2000 respectively, and used by my wife and son.

I have used the non-simple sharing scheme described in

http://www.practicallynetworked.com/sharing/xp_filesharing/index.htm

I have accounts set up for wife and son on the main PC. They also use
passwords to login into their respective PC's. Their username and password
on their PC's matches the one I have set up on my PC. Everything is behind
a cable modem router/switch.

When they log-in to their PC, they see the printer but cannot access it
until they go to
MyNetworkPlaces|EntireNetwork|MSWindowsNetwork|workgroupname| and click on
my PC. They then get a login prompt where they supply their username and
password (the same as on my PC). After that, they can access the printer
and use it.

Question: is there any way for the shared printer to be available to them
without the extra step of logging into my PC ?

 

[Hans-Georg Michna]

I have XPPro running on the main PC (the one I use with an attached
printer that I share with 2 other PC's. The other PC's run XP Home and Win
2000 respectively, and used by my wife and son.

I have used the non-simple sharing scheme described in

http://www.practicallynetworked.com/sharing/xp_filesharing/index.htm

I have accounts set up for wife and son on the main PC. They also use
passwords to login into their respective PC's. Their username and password
on their PC's matches the one I have set up on my PC. Everything is behind
a cable modem router/switch.

When they log-in to their PC, they see the printer but cannot access it
until they go to
MyNetworkPlaces|EntireNetwork|MSWindowsNetwork|workgroupname| and click on
my PC. They then get a login prompt where they supply their username and
password (the same as on my PC). After that, they can access the printer
and use it.

Question: is there any way for the shared printer to be available to them
without the extra step of logging into my PC ?

Aloke,

the simplest way I can imagine is to enable Simple File Sharing
on your computer. Then you wouldn't even have to use the same
usernames and passwords.

The setting is in Windows Explorer, Tools, Folder options, View,
Enable Simple File Sharing.

If you still have any problems, please ask here again.

Hans-Georg

 

[Aloke Prasad]

Aloke,

the simplest way I can imagine is to enable Simple File Sharing
on your computer. Then you wouldn't even have to use the same
usernames and passwords.

Is there any way to do this without Simple File Sharing? I'd rather use
Access Control method because of it's better security.

 

[Hans-Georg Michna]

Is there any way to do this without Simple File Sharing? I'd rather use
Access Control method because of it's better security.

Aloke,

what exactly does "better security" mean? More security?
Security that is harder to break? Being secure from what danger?

The most important kind of security is that you never run any of
your computers connected to the Internet without all current
security patches installed and without a working, enabled
firewall. This has nothing to do with the kind of file sharing,
but it is the kind of security most computer users should be
worrying about first. (Current average survival time until first
infection for an unpatched, not firewalled PC is 16 minutes.)

From your first message, where you described that you gave the
users identical usernames and passwords, I deduced that you were
trying to achieve in a roundabout way exactly what Simple File
Sharing was designed for. That's why I proposed Simple File
Sharing.

What particular security are you worrying about? Hostile access
from the Internet? From guests in your house? Simple File
Sharing doesn't make that any easier. It would be better if you
could describe exactly what particular security you desire. Then
we can find out the best way to achieve that security.

The answer to your question is, yes, there are ways to allow
access to a printer for everyone without having to enter a
username and password. Fundamentally this is done through the
Guest account in both kinds of file sharing.

I'll wait for your next reply before writing stuff you may not
need.

Hans-Georg

 

[Lanwench [MVP - Exchange]]

I have XPPro running on the main PC (the one I use with an
attached printer that I share with 2 other PC's. The other PC's run
XP Home and Win 2000 respectively, and used by my wife and son.

I have used the non-simple sharing scheme described in

http://www.practicallynetworked.com/sharing/xp_filesharing/index.htm

I have accounts set up for wife and son on the main PC. They also use
passwords to login into their respective PC's. Their username and
password on their PC's matches the one I have set up on my PC.
Everything is behind a cable modem router/switch.

When they log-in to their PC, they see the printer but cannot access
it until they go to
MyNetworkPlaces|EntireNetwork|MSWindowsNetwork|workgroupname| and
click on my PC. They then get a login prompt where they supply their
username and password (the same as on my PC). After that, they can
access the printer and use it.

Question: is there any way for the shared printer to be available to
them without the extra step of logging into my PC ?

What are the permissions set on the printer share on your PC? This should be
no different than allowing them access to a file share.

 

[Aloke Prasad]

Aloke,

what exactly does "better security" mean? More security?
Security that is harder to break? Being secure from what danger?

I am concerned about access to my PC from other users on the internet. I'm
not worried about other PC's in the house accessing my files.

I do have a cable router/switch, Zonealarm Pro, EZAV, Adaware, Spybot and I
keep everything (firmware, drivers, software) updated.

Simple file sharing seemed to open up the contents of my PC to anyone who
manages to get to may LAN, say through a trojan one of my other PC's. My
wife and son use those, and while I try to keep those updated as well, I
cannot be sure of what they are doing on a day-to-day basis...

I figured the more layers of security, the better.

 

[Hans-Georg Michna]

I am concerned about access to my PC from other users on the internet. I'm
not worried about other PC's in the house accessing my files.

I do have a cable router/switch, Zonealarm Pro, EZAV, Adaware, Spybot and I
keep everything (firmware, drivers, software) updated.

Simple file sharing seemed to open up the contents of my PC to anyone who
manages to get to may LAN, say through a trojan one of my other PC's. My
wife and son use those, and while I try to keep those updated as well, I
cannot be sure of what they are doing on a day-to-day basis...

I figured the more layers of security, the better.

Aloke,

our discussion branches off in two directions. I'll try to
follow both. First to the problem on hand.

With classic file sharing, the user is authenticated by his
username and password. If the printer's access permissions
include this user, he should be able to print immediately. If,
however, the user gets a username and password question, then
the usual cause is that the user has not been given the right to
use this printer. (Actually there are several rights here, only
one being the right to print.)

The normal way to solve this is to add a group to the printer's
access rights, of which the user is a member. Examples are Users
or Powerusers. Alternatively it is also possible, and reasonable
in very small networks, to add the user directly.

A simpler alternative is to give the Everyone group the right to
print, then the user account wouldn't even be needed here. You'd
run the theoretical risk that an intruding virus can print. -)

Now for the more theoretical question of how secure Simple File
Sharing is, just in case this is still of any interest.

In your situation, with users inside your LAN having the same
usernames and passwords, I still think there is essentially no
difference between simple and classic file sharing. Seen from
the outside, security is pretty much the same, the only small
difference perhaps being the access rights to the Shared
Documents folder.

But I would think that some virus or worm intruding and reading
the Shared Documents should be one of the remotest worries
compared to the actual damage such malware does. In fact I doubt
that any virus exists that even attempts to do that. Usually the
malware is up to other things, like procreating, showing you
ads, or sending spam.

In short, you're not gaining any significant security by using
classic file sharing. Also, classic file sharing does not add
any layer of security. It only allows more detailed security
settings, possibly more than you need.

You need classic file sharing when you want to restrict access
from inside the LAN. It does not help against dangers coming
from the outside, from the Internet.

That said, there are still good arguments for using classic file
sharing, the biggest one being that one learns about the complex
security settings in Windows XP and NTFS, for example about
inheritance of these settings and the means to control these
settings and their inheritance. It may be helpful to read a good
book about the topic.

The funny thing in this case is that simple file sharing was
invented for precisely the type of network you are running, to
prevent the risk that the user runs headlong into the unneeded
complexities of classic file sharing. Of course, if the idea is
taking hold that classic file sharing is safe, while simple file
sharing is unsafe, then the whole idea of simple file sharing
has failed in a very fundamental way. -)

I hope you don't mind my long stories. -) Sometimes they are
fun.

Hans-Georg

 

[Aloke Prasad]

Aloke,

our discussion branches off in two directions. I'll try to
follow both. First to the problem on hand.

With classic file sharing, the user is authenticated by his
username and password. If the printer's access permissions
include this user, he should be able to print immediately. If,
however, the user gets a username and password question, then
the usual cause is that the user has not been given the right to
use this printer. (Actually there are several rights here, only
one being the right to print.)

The normal way to solve this is to add a group to the printer's
access rights, of which the user is a member. Examples are Users
or Powerusers. Alternatively it is also possible, and reasonable
in very small networks, to add the user directly.

A simpler alternative is to give the Everyone group the right to
print, then the user account wouldn't even be needed here. You'd
run the theoretical risk that an intruding virus can print. -)

Now for the more theoretical question of how secure Simple File
Sharing is, just in case this is still of any interest.

In your situation, with users inside your LAN having the same
usernames and passwords, I still think there is essentially no
difference between simple and classic file sharing. Seen from
the outside, security is pretty much the same, the only small
difference perhaps being the access rights to the Shared
Documents folder.

But I would think that some virus or worm intruding and reading
the Shared Documents should be one of the remotest worries
compared to the actual damage such malware does. In fact I doubt
that any virus exists that even attempts to do that. Usually the
malware is up to other things, like procreating, showing you
ads, or sending spam.

In short, you're not gaining any significant security by using
classic file sharing. Also, classic file sharing does not add
any layer of security. It only allows more detailed security
settings, possibly more than you need.

You need classic file sharing when you want to restrict access
from inside the LAN. It does not help against dangers coming
from the outside, from the Internet.

That said, there are still good arguments for using classic file
sharing, the biggest one being that one learns about the complex
security settings in Windows XP and NTFS, for example about
inheritance of these settings and the means to control these
settings and their inheritance. It may be helpful to read a good
book about the topic.

The funny thing in this case is that simple file sharing was
invented for precisely the type of network you are running, to
prevent the risk that the user runs headlong into the unneeded
complexities of classic file sharing. Of course, if the idea is
taking hold that classic file sharing is safe, while simple file
sharing is unsafe, then the whole idea of simple file sharing
has failed in a very fundamental way. -)

I hope you don't mind my long stories. -) Sometimes they are
fun.

Hans-Georg,

Thanks for your wonderful explanation.

I was basing most of my settings on the PracticallyNetworked article by
Steve Winograd and Ron Lowe.

Do you have a web site where these aspects are discussed in some detail?

I tend to look for complexities and nuances ...

 

[Hans-Georg Michna]

Thanks for your wonderful explanation.

I was basing most of my settings on the PracticallyNetworked article by
Steve Winograd and Ron Lowe.

Aloke,

their articles are very good, and they explain how to set up a
network step by step. By the way, they are both fellow MVPs like
me, and I have met Steve, and probably Ron too, in person.
Steve, along with some other MVPs, is a master in knowing and
explaining network details.

As far as I can tell, the page you read was explaining how to
set up classic file sharing. This is not to mean that Simple
File Sharing is useless or unsafe to use.

Do you have a web site where these aspects are discussed in some detail?

Sorry, no. My web pages are all geared towards errors and
defects, how to find them and how to repair or at least
circumvent them. I have not made any step by step guides or
backgrounders. But perhaps a few links can help. I append them
below.

I tend to look for complexities and nuances ...

It's usually a good idea to learn more.

Your actual problem is not yet entirely solved, or is it? I'd
feel best if your network ran smoothly.

Hans-Georg


How to configure file sharing in Windows XP
http://support.microsoft.com/?kbid=304040

How to Set Up a Small Network with Windows XP Home Edition
(PART 1)
http://support.microsoft.com/?kbid=813936

For a 60 page tutorial that covers networking with several
Windows versions go to
http://www.microsoft.com/downloads/details.aspx?familyid=87c0a6db-aef8-4bef-925e-7ac9be791028
and download the Word document FileSharing.doc.

Troubleshooting File and Printer Sharing in Microsoft® Windows®
XP
http://www.microsoft.com/downloads/...8d-6b4a-448e-a632-076f98a351a2&displaylang=en

Troubleshooting Internet Connection Firewall on Microsoft®
Windows® XP
http://www.microsoft.com/downloads/...93-ad93-492f-b74b-97c2fc44e08b&displaylang=en

Troubleshooting Internet Connection Sharing on Microsoft®
Windows® XP
http://download.microsoft.com/download/9/3/1/9315bee6-498e-493e-83a6-2a9d8631878d/ICS_Tshoot.doc

 

[Aloke Prasad]

It's usually a good idea to learn more.

Your actual problem is not yet entirely solved, or is it? I'd
feel best if your network ran smoothly.

Given my setup, with access control networking, user accounts on the XPPro
system, how do I disable login prompts on the clients to share the printer?

You had mentioned early in the thread that could be done .. I'd like to
know how to.

 

[Aloke Prasad]

"Lanwench [MVP - Exchange]"

Aloke Prasad wrote:

What are the permissions set on the printer share on your PC? This should
be
no different than allowing them access to a file share.

"Everyone" group has access to print, manage the printer and the documents.
I added "Users" group to have such access as well. The other accounts are
in "Users" group.

 

[Aloke Prasad]

Given my setup, with access control networking, user accounts on the XPPro
system, how do I disable login prompts on the clients to share the
printer?

You had mentioned early in the thread that could be done .. I'd like to
know how to.

Hans-Georg,

I figured that you had addressed this earlier.

"The normal way to solve this is to add a group to the printer's
access rights, of which the user is a member. Examples are Users
or Powerusers. Alternatively it is also possible, and reasonable
in very small networks, to add the user directly."

I added "Users" group to the access control list for the printer. The other
users are members of "Users".

"A simpler alternative is to give the Everyone group the right to
print, then the user account wouldn't even be needed here."

The odd thing is that "Everyone" group already had access to the printer.
Despite that, they had to log-on to my PC to connect to the printer ...

 

[Hans-Georg Michna]

I added "Users" group to the access control list for the printer. The other
users are members of "Users".

"A simpler alternative is to give the Everyone group the right to
print, then the user account wouldn't even be needed here."

The odd thing is that "Everyone" group already had access to the printer.
Despite that, they had to log-on to my PC to connect to the printer ...

Aloke,

I understand the problem is solved now, which is good.

As to the Everyone group, that works by using the Guest account
to log on. Classic file sharing always automatically tries a
second access through the Guest account when the user account
does not have sufficient access rights.

The reason why Everyone doesn't work for you is that the Guest
account logon also failed. Possible causes are:

* Guest account disabled.
* Guest account logon not allowed through a group policy.
* Anonymous logon restricted through the RestrictAnonymous key
in the registry.

Details are described in http://www.michna.com/kb/wxnet.htm. You
can search the document for "Guest account", for "policy", and
for "RestrictAnonymous" to find the details.

Hans-Georg

 

[Aloke Prasad]

The reason why Everyone doesn't work for you is that the Guest
account logon also failed. Possible causes are:

* Guest account disabled.
* Guest account logon not allowed through a group policy.
* Anonymous logon restricted through the RestrictAnonymous key
in the registry.

Details are described in http://www.michna.com/kb/wxnet.htm. You
can search the document for "Guest account", for "policy", and
for "RestrictAnonymous" to find the details.

Thanks for the URL.

The Guest account was indeed disabled on my system.

I wish we could depend on Linksys router firmware and open up the access to
our LANs.

I don't know of any issues with the router .. I'm just generally suspicious
in nature

 

[Hans-Georg Michna]

I wish we could depend on Linksys router firmware and open up the access to
our LANs.

I don't know of any issues with the router .. I'm just generally suspicious
in nature

Aloke,

what do you want to achieve?

Linksys routers often seem to cause problems, but of course not
everywhere. Some of them actually work. -)

Hans-Georg

 

[Aloke Prasad]

Aloke,

what do you want to achieve?

Linksys routers often seem to cause problems, but of course not
everywhere. Some of them actually work. -)

Ideally, I would like hackers on the internet to not access to my LAN,
assuming I don't have a virus, spyware or trojan on my system (that's my
responsibility).

On my LAN, I (using XP Pro) would like to read and write (and otherwise
access) any resource on my other 2 PC's (Win2000 Pro and XP Home). I would
like them to have access to selected resources on my PC (printer and
directories I choose).

 

[Hans-Georg Michna]

Ideally, I would like hackers on the internet to not access to my LAN,
assuming I don't have a virus, spyware or trojan on my system (that's my
responsibility).

Aloke,

a router keeps hackers out pretty well if its firewall is
enabled. A router uses NAT (Network Address Translation), which
already makes your local computers inaccessible from the outside
even without any further firewall protection.

On my LAN, I (using XP Pro) would like to read and write (and otherwise
access) any resource on my other 2 PC's (Win2000 Pro and XP Home). I would
like them to have access to selected resources on my PC (printer and
directories I choose).

XP Home has a limitation here. You can share certain folders,
but if you share anything on XP Home, you share it to everyone
in the LAN.

The other computers can be more selective, XP Pro needs Simple
File Sharing disabled for that. Then these computers can share
objects, i.e. folders, files, and printers, selectively, such
that only certain users can have certain access rights.

You need to know that a user needs two access rights at the same
time to access anything, one for the share, then one for the
object itself.

You need an account for each user on each server with the same
username and password as on the accessing client.

That's basically all there is to it.

Hans-Georg

 

[Aloke Prasad]

XP Home has a limitation here. You can share certain folders,
but if you share anything on XP Home, you share it to everyone
in the LAN.

I am sharing resources on the XPHome system by assigning a password to the
Guest account. Steve Winograd had suggested this many months ago. That
requires whoever gets into my LAN from outside to know the password before
getting access to the HPHome PC resources.

The other computers can be more selective, XP Pro needs Simple
File Sharing disabled for that. Then these computers can share
objects, i.e. folders, files, and printers, selectively, such
that only certain users can have certain access rights.

You need an account for each user on each server with the same
username and password as on the accessing client.

That is the way things are set up. The twist was that "Everyone" rights was
not working (without logging in) because the Guest account on the XPPro had
been disabled. As you explained, I added "Users" to the ACL to fix that.

Thanks again. You are a paragon of patience.

 

[Hans-Georg Michna]

Thanks again. You are a paragon of patience.

Aloke,

thanks. -)

Hans-Georg