File and Printer Sharing - Security

[Guest]

I'm looking for information about the security of using File and Printer
Sharing with XP. We have had this disabled on our departments computers
since the days of NT due to many security issues with that OS. However, I
have recently come across some important remote administrative tools which
require F&P sharing to be enabled. Could somebody please lead me to
articles, microsoft postings, etc... that describe the advantages or
disadvantages of having this service enabled?

One more item, is there a way to enable this service using Group Policy? If
so, please guide me through step-by-step and I'm pretty new to GP. Thank you
so much,
Jason

 

[Torgeir Bakken \(MVP\)]

I'm looking for information about the security of using File and Printer
Sharing with XP. We have had this disabled on our departments computers
since the days of NT due to many security issues with that OS. However, I
have recently come across some important remote administrative tools which
require F&P sharing to be enabled. Could somebody please lead me to
articles, microsoft postings, etc... that describe the advantages or
disadvantages of having this service enabled?

One more item, is there a way to enable this service using Group Policy? If
so, please guide me through step-by-step and I'm pretty new to GP.

Hi

You might get something to work with snetcfg.exe...

If you want to use Snetcfg.exe to _enable_ File & Print Sharing (F&PS
already installed, but the checkbox is not checked), you will have to
uninstall F&PS first, and then install again (using snetcfg.exe for
both tasks). This will make the checkbox checked.

More about snetcfg.exe and F&PS here:

http://groups.google.co.uk/[email protected]

To do this "remotely":

If the users are local admins, you can do it in a logon script, and
if not, you could do it in a computer startup script (with a GPO)
that runs as part of the boot up process (before the user logs in).
It runs under the system context and has admin rights.

To be able to access files (e.g. snetcfg.exe) over the network from the
computer startup script, you could put the file(s) on a network share
and grant read access for the AD group "Domain Computers" to the share.

Alternatively, from the startup script, you could map a drive on
the fly, like this:

sDomainUser = "arp.corp\computer_fix"
sPswd = "something"

Set oNetwork = CreateObject("Wscript.Network")

oNetwork.MapNetworkDrive _
"Y:", "\\server\netlogon\some folder",, sDomainUser, sPswd