How to grant a group rights to manage shares?

[Guest]

Hi there,

Im currently trying to clean up security for our helpdesk users (all domain
admins ouch!). They need to maintain the ability to grant users access to
shares on fileservers and the only way I can see to do this is either make
them members of the local admins or server operators group. Unfortunately
some of the fileservers are DCs as well so they then need to be members of
the BUILTIN admin or server operators groups (which I'd prefer not to do).

Can anyone think of another way that I can grant the ability to manage
shares (and printers) without resorting to the local or builtin groups? I
read an article which talks about using TweakUI to modify registry
permissions however this only works on XP & Windows 2003, we still have
mostly W2k servers...

Thanks in advance

Anthony

 

[Jorge de Almeida Pinto]

TRY the following:

Share creation restrictions. Access to share operations such as creating a
share, changing share information, and deleting a share, are controlled by
security descriptors. On a server, administrators can decide who can/cannot
perform certain share operations. For example, on a file server,
administrators should be able to delegate or remove Power Users to create
file shares. The ability to create/delete shares is controlled by a ACE in
the security descriptor, where Power Users can be added/removed from the
security descriptor to allow or deny the ability.
The security descriptors are stored in the registry by SRV service, under
LanManServer\DefaultSecurity, as following: . SrvsvcShareFileInfo,
REG_BINARY: Permission to control access on file share operation.

. SrvsvcSharePrintInfo, REG_BINARY: Permission to control access on
print share operation.

. SrvsvcShareAdminInfo, REG_BINARY


DCs should only be accessed by trusted people and most of the time (and best
practice) only domain admins should be able to do that

 

[Guest]

I had a look at those but the only way I could see to read them (since they
are in Binary) was with the tweakui utility, any other way of
reading/manupulating these keys?

 

[Jorge de Almeida Pinto]

you could use the tweakui utility to configure one machine and copy the reg
value to other servers