Stubborn file permission questions

[Eric]

I have a two-computer network -- one running XP Home and
the other running XP Pro. It's the XP Pro machine I have
questions about. I have three separate questions:

(1) When I try to access file permissions I can only see
the computer XP Pro is loaded onto, not the XP Home
machine. What settings do I need to set on both machines
to fix this?

(2) Under Administrative Tools>Local Security
Policy>Security Settings>Local Policies>User Rights
Assignment>Access this computer from the network, you are
able to assign which computers can access your computer.
Does this override the settings that you established in
the Sharing and Permissions. In other words, if you set
up the permissions for a computer to access a file on
your computer, and you then gave a security policy that
didn't allow that computer to access your computer, would
that other computer then be unable to view the file on
your computer, even though it has "permission" to do so?

(3) If you only wanted a few computers on the network to
be able to access shared filed on your computer, could
you do this via the administrative tools, and not have to
set it for each file or folder that you are sharing, and
then just use the permissions to further restrict who can
see something?

Thanks,
Eric

 

[Steve Winograd [MVP]]

I have a two-computer network -- one running XP Home and
the other running XP Pro. It's the XP Pro machine I have
questions about. I have three separate questions:

(1) When I try to access file permissions I can only see
the computer XP Pro is loaded onto, not the XP Home
machine. What settings do I need to set on both machines
to fix this?

(2) Under Administrative Tools>Local Security
Policy>Security Settings>Local Policies>User Rights
Assignment>Access this computer from the network, you are
able to assign which computers can access your computer.
Does this override the settings that you established in
the Sharing and Permissions. In other words, if you set
up the permissions for a computer to access a file on
your computer, and you then gave a security policy that
didn't allow that computer to access your computer, would
that other computer then be unable to view the file on
your computer, even though it has "permission" to do so?

(3) If you only wanted a few computers on the network to
be able to access shared filed on your computer, could
you do this via the administrative tools, and not have to
set it for each file or folder that you are sharing, and
then just use the permissions to further restrict who can
see something?

Thanks,
Eric

The following answers apply to computers, like yours, that are in a
workgroup. They don't apply to computers in a domain, where a domain
controller running Windows 2000 Server or Windows Server 2003 provides
security and access control for all computers.

(1) It isn't possible to see accounts on other computers. Create
matching user accounts (same user name and password) on both
computers. Permissions that you grant to an account on the XP Pro
computer will also apply to the same account on the XP Home computer.

(2) I don't see anything in User Rights Assignment | "Access this
computer from the network" that lets you specify which computers can
connect over the network. All that I see are users and user groups.
Am I missing something?

Network access settings override settings in Sharing and Permissions.
If you deny network access, that user or group won't be able to see
any shares on your computer. If you enable network access, shares
will be visible to that user. Access to a specific share will then be
allowed or denied based on the permissions defined for that share.

(3) I don't know of any way to control access based on computer names.
Access control for users and user groups works the way that you
describe.

BTW, here's a shortcut to the window where you can configure local
policies: Start | Run | secpol.msc
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Eric]

Thanks, Steve. I appreciate the answers!

-----Original Message-----