Anonymous access to shares

[Guest]

Hello,

Is it possible to allow anonymous access to shares without having to enable
the Guest account.

I've tried setting Sharing and NTFS permissions and modify the Local GPO to
allow the built in ANONYMOUS LOGON account. No luck. I can't access the share
without getting a prompt for the user name password.

Everything out on the web says to enable the Guest account. I know this will
work but it is not the way i want to go. Am I stuck with enabling the Guest
account or am i missing a setting in the Local GPO. Can this be done.

Thanks in advanced for your feedback.
Josiah

 

[Doug Knox - [MS-MVP]]

You can try the following in GPEDIT.

Computer Configuration, Windows Settings, Security Settings, Local Policies,
Security Options. Locate the entry

Network access: Let Everyone permissions apply to anonymous users

Set this to Enabled. You may need to reboot.

 

[Guest]

That was one of the first things i tried. This does not work.

Josiah

 

[HEMI-Powered]

=?Utf-8?B?Sm9zaWFo?= added these comments in the current
discussion du jour ...

Hello,

Is it possible to allow anonymous access to shares without
having to enable the Guest account.

That is extremely dangerous, as is using Guest! NEVER give anyone
unfettered access to your system where they can putz around doing
God knows what without your knowledge. The only exception I can
think of is if you have a PC kinda kiosk that your business
customers will sit in front of.

I've tried setting Sharing and NTFS permissions and modify the
Local GPO to allow the built in ANONYMOUS LOGON account. No
luck. I can't access the share without getting a prompt for
the user name password.

Everything out on the web says to enable the Guest account. I
know this will work but it is not the way i want to go. Am I
stuck with enabling the Guest account or am i missing a
setting in the Local GPO. Can this be done.

Thanks in advanced for your feedback.
Josiah

The whole idea to XP or Vista security, such that it is, is for
the owner, i.e., the Administrator with a capital "A" to control
usage on the system by creating as many accounts as it takes. If
you're sharing across a network, are you sure you really want
people to access your system files or maybe things you consider
to be confidential information? That's exactly why I said it is
dangerous, they are in effect remotely logging into your PC and
snooping around. Now, maybe I have a bad view of people, but
either an accidental mistake or an intentional one - e.g., a
hacker who wants to plant spyware on your PC - you wouldn't know
for hours, maybe days or even weeks that things have been added,
deleted, or modified.

So, please clarify what you're trying to accomplish.

 

[HEMI-Powered]

Doug Knox - [MS-MVP] added these comments in the current
discussion du jour ...

You can try the following in GPEDIT.

Computer Configuration, Windows Settings, Security Settings,
Local Policies, Security Options. Locate the entry

Network access: Let Everyone permissions apply to anonymous
users

Set this to Enabled. You may need to reboot.

Doug, see my reply to the OP. I didn't know about what you suggest,
but why would MS provide such a huge loophole in an O/S they
advertise to the world as ultra-secure, i.e., XP SP2 or Vista? What
is the point of having good security at the systems level if a
less-than-fully-knowledgeable owner undoes it all. Plus, I see the
OP already tried this.

I will be quite interested if the OP comes back and explains why
they want to do this in the first place, i.e., is this a person
system with multiple users in the household networking with a
simple MS network around the house to other PCs or some sort of
business or academic environment that depends on anonymous usage.
If the former, and there're kids involved, look out! If the latter,
I would understand the wish to do that, but I would also try to
install some safeguards beyond limiting access rights to protect
the integrity of the system.

 

[Guest]

That is extremely dangerous, as is using Guest! NEVER give anyone
unfettered access to your system where they can putz around doing
God knows what without your knowledge. The only exception I can
think of is if you have a PC kinda kiosk that your business
customers will sit in front of.

That is just hysterical bar-talk, with no basis in fact. Guest or anonymous
access is only dangerous if mis-applied in such a way as to allow
unpriveleged users to do things they oughtn't.

Administrator-level access can be even more dangerous if mis-applied,
witness the number of small LANs where users have inadvertently been made
Domain Admins instead of Local Admins, and thus have the rights to trash the
entire network if they so choose. Yet, management are most likely blissfully
unaware that just one disgruntled employee could literally as well as
figuratively put them out of business with a few dozen keystrokes in a
commandprompt.

As for anonymous share access, I've made concerted efforts in the past to
get that to work, and never succeeded. Guest access unfortunately removes the
user-level security from ALL shares, not just the one, so may not be a
suitable workaround.

 

[HEMI-Powered]

=?Utf-8?B?QW50ZWF1cw==?= added these comments in the current
discussion du jour ...

That is just hysterical bar-talk, with no basis in fact. Guest
or anonymous access is only dangerous if mis-applied in such a
way as to allow unpriveleged users to do things they oughtn't.

Hysterical bar talk? My good friend, I was Information Security
Manager at Chrysler for the last 5 1/2 years of my career before
retiring in early 2002, and it is neither hysterical or bar talk.
Neither am I propogating urban legends. I've seen it happen, and
I've listened in on any number of NGs with dozens of people
moaning and groaning after opening up their system to casual use.

Administrator-level access can be even more dangerous if
mis-applied, witness the number of small LANs where users have
inadvertently been made Domain Admins instead of Local Admins,
and thus have the rights to trash the entire network if they
so choose. Yet, management are most likely blissfully unaware
that just one disgruntled employee could literally as well as
figuratively put them out of business with a few dozen
keystrokes in a commandprompt.

This is precisely why I say my views are valid and sound. It
isn't that it is impossible to do this right, it is that it is
SO, again IMO, difficult for even reasonably technically
knowledgeable people to do it "right", much less someone not
personally skilled in both security and networking.

I am out-of-date and getting more out-of-date every day since I
retired, just as the problem has accelerated and is doing so
today, but the general principles are still the same. No matter
what MS may brag about, XP's security is like swiss cheese. It
seems that maybe once a week somebody will ask an easy one like
"can I protect a folder from access by others?" If I understand
the answers they get from the MVPs, no it isn't, you have to do
it via account priveliges.

There is far more functionality to XP that I understand because I
don't have a specific enough need to dig into it by at least
buying the appropriate books from MS, Que, or others to learn
about it. But, that very same complexity, especially when
involving shared volumes across a LAN, WAN, or even allowing
remote Internet access, is EXACTLY why it can be frustratingly
difficult to accomplish what you want to do and NOT inadvertantly
"mis-apply" it.

As for anonymous share access, I've made concerted efforts in
the past to get that to work, and never succeeded. Guest
access unfortunately removes the user-level security from ALL
shares, not just the one, so may not be a suitable workaround.

In a friendly a way as I know how, please reflect on this: my
Momma had a saying that said "what happens, happens for the
best". Even at the very worst/lowest times in my entire life, she
has NEVER been wrong, albeit it may take a while to see the
light. So, maybe your failure to find a way to get true anonymous
share access will ultimately be revealed to you as a God Damn
thing you didn't succeed at.

Your last comment about Guest again is PRECISELY why I said THAt
is dangerous. The main issue I have with XP's security (again, I
know no-thing about Vista) is that it severely lacks in
granularity. I mean, I either have to restrict almost everything
or I have to grant literally everything.

When I first installed an XP box for my wife to replace her aging
Win 98 SE, I tried setting her account to "limited" so that she
couldn't accidently damage it, which in turn would give ME major
headache, right? But, within a couple days, I had to turn on
admin rights because so much stuff wouldn't/couldn't work. Even
some simple things that PSP 9 tried to do were blocked, her AV
updates wouldn't run, lots of things either failed to run at all,
the app/utility itself completely failed, or whatever she was
trying to do, she couldn't.

I don't know what you call this, but I call it LESS than the best
security possible at the time of SP2, and damn near of no use at
all. One more time, I stopped bashing MS some time back, so this
isn't that. But for all its vaunted security, it regularly causes
me pain and time with my simple 2-PC network so we can share
files and she can access my cable modem. What happens is one or
the other of the 2 PCs, or both, complain that it isn't
authorized to share to the other! Each time that happens,
generally after a bunch of updates and I have to restart them
both, I discover some other minor place I forgot to put either
her account or mine as having admin rights into the right place.

I'd call this fraud and negligence, except that I don't bash. So,
I'll just leave it as "I don't think much of SP2's security."

Now, if you're still talking to me and haven't written me off as
a fool, why don't you and I collaborate so we learn from each
other. And, please know that for the AVERAGE user, and cerainly
the novice user, I stand by my comment that UNFETTERED access is
dangerous.

BTW, are you coming in here via Google Groups or something? I
hear that these entries into Usenet are where bizzare nym strings
like your ?Utf-8?B?QW50ZWF1cw==?=
<[email protected]>
come from, rather than the usual nym/handle/username that most of
us use.