Re-enabling network shares for remote Guest users

[Jaelani]

Hello,

I have two PCs - one primary and the other is the secondary. Both use
Windows XP Professional and I intend to use both for client & server,
just simple home & private networking. In my primary PC, a long time
ago I disabled access of remote Guest (or anonymous) users to access
(read-only) my network shares - allowing access only for users
registered in local system. The problem is that I forgot how and what
did I do to disable it and I need to re-enabling it again.

My primary PC can see my secondary PC including its shares and are all
accessible under the Guest user restrictions. My secondary PC can see
my primary PC but it's not allowed to see my shares.

In my primary PC, I make sure that the Guest user is enabled via Local
Users and Groups MMC. I've also searched all the settings in Group
Policy about Guest access to the network shares and disabled the
Windows Firewall. But my secondary PC still not allowed to see my
primary PC's shares.

Is there other settings I've missed?
Thanks in advance.


Regards,
Jaelani


*This is a reposted message from
microsoft.public.windowsxp.configuration_manage

 

[John Wunderlich]

m:

Hello,

I have two PCs - one primary and the other is the secondary. Both
use Windows XP Professional and I intend to use both for client &
server, just simple home & private networking. In my primary PC, a
long time ago I disabled access of remote Guest (or anonymous)
users to access (read-only) my network shares - allowing access
only for users registered in local system. The problem is that I
forgot how and what did I do to disable it and I need to
re-enabling it again.

My primary PC can see my secondary PC including its shares and are
all accessible under the Guest user restrictions. My secondary PC
can see my primary PC but it's not allowed to see my shares.

In my primary PC, I make sure that the Guest user is enabled via
Local Users and Groups MMC. I've also searched all the settings in
Group Policy about Guest access to the network shares and disabled
the Windows Firewall. But my secondary PC still not allowed to see
my primary PC's shares.

Is there other settings I've missed?
Thanks in advance.


Regards,
Jaelani

The two ways I know of:
1) Group Policy Editor
Computer Config->Windows Settings->Local Policies->Security Opt->
"Accounts: Guest Account Status"

and

2) From Command Prompt Window:

net user guest /Active:Yes (or No)

HTH,
John

 

[Jaelani]

I found a solution by changing a Group Policy setting but I don't know
if it's wise to change it or not. The setting is at:

Computer Configuration-> Windows Settings-> Security Settings-> Local
Policies-> User Rights Assignment-> Deny access to this computer from
the network

Previously, it's set to: SUPPORT_xxxxxxxx, Guest
Then changed to: SUPPORT_xxxxxxxx
Removing the Guest user.

Is my previous setting the default setting?

I know this makes my network unsecure, but once I get the sharing
problem solved, I'm planning to block all Microsoft Network ports
outside my local network via Windows Firewall. This should secure my
network, right?

I also have a third-party file manager that can display detailed
information about available computer. They are:

Network Group: NETBIOS Name, Workgroup, Domain, Comment.
OS Group: Network Name, OS Name, LAN Manager.

My primary PC can see all the information but the secondary PC can't
see the OS Group information. Does this means anything?

 

[John Wunderlich]

m:

I found a solution by changing a Group Policy setting but I don't
know if it's wise to change it or not. The setting is at:

Computer Configuration-> Windows Settings-> Security Settings->
Local Policies-> User Rights Assignment-> Deny access to this
computer from the network

Previously, it's set to: SUPPORT_xxxxxxxx, Guest
Then changed to: SUPPORT_xxxxxxxx
Removing the Guest user.

Is my previous setting the default setting?

I know this makes my network unsecure, but once I get the sharing
problem solved, I'm planning to block all Microsoft Network ports
outside my local network via Windows Firewall. This should secure
my network, right?

I also have a third-party file manager that can display detailed
information about available computer. They are:

Network Group: NETBIOS Name, Workgroup, Domain, Comment.
OS Group: Network Name, OS Name, LAN Manager.

My primary PC can see all the information but the secondary PC
can't see the OS Group information. Does this means anything?

If I were looking to secure file sharing, I would turn off Simple
File Sharing and disable the Guest account (with the "net user"
command, not the user control panel). Then create identical logins
on all machines with the same password. Finally adjust the access
permissions to shares so that only known logins can have access to
the file shares. Most home NAT (network address translation) routers
will prevent incoming connections from outside the local network
unless you configure the router to allow it. I would trust this more
than Windows Firewall.

A couple of Microsoft articles to read:

"How to configure file sharing in Windows XP"
(Concentrates on Simple File Sharing)
<http://support.microsoft.com/kb/304040>

"Windows XP Baseline Security Checklists"
<http://technet.microsoft.com/en-us/library/cc751488.aspx>

Hope this helps,
John