Thanks Chuck--Added Win98 user to XP machine's permissions

[Barry]

Chuck, thank you for the information you've put into
other posts; it has enabled me to add my son on his
machine as a user on my machine. What I was missing was
adding an account for him on my machine.

But, he never uses my machine. Is there no other way?
Must I have an account for him on my machine if I want to
give him permissions?

He has a Win98SE. I have a WinXPProSP1. I have Simple
File Sharing disabled, and my Security model is set to
Classic - local users authenticate as themselves. Our
network is peer-to-peer, and I have my IP Config set so
we can use ICS, (and it works).

Windows IP Configuration
Host Name . . . . . . . . . . . . : ThinkCentre
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Wireless Network Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : NETGEAR WG311
802.11g Wireless PCI Adapter
Physical Address. . . . . . . . . : 00-09-5B-97-
FA-B0
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :

PPP adapter Cumberland Technologies:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : WAN
(PPP/SLIP) Interface
Physical Address. . . . . . . . . : 00-53-45-00-
00-00
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 151.205.241.61
Subnet Mask . . . . . . . . . . . :
255.255.255.255
Default Gateway . . . . . . . . . : 151.205.241.61
DNS Servers . . . . . . . . . . . : 66.59.100.87
205.166.61.160
NetBIOS over Tcpip. . . . . . . . : Disabled

 

[Lanwench [MVP - Exchange]]

Chuck, thank you for the information you've put into
other posts; it has enabled me to add my son on his
machine as a user on my machine. What I was missing was
adding an account for him on my machine.

But, he never uses my machine. Is there no other way?

He does use your machine if he connects to shares on it across the network.

Must I have an account for him on my machine if I want to
give him permissions?

Yes, unless you want to enable Guest, which I don't recommend. Just set up
the NTFS security properly so he can't get into stuff he isn't supposed to -
either locally or across the network.

 

[Chuck]

Chuck, thank you for the information you've put into
other posts; it has enabled me to add my son on his
machine as a user on my machine. What I was missing was
adding an account for him on my machine.

But, he never uses my machine. Is there no other way?
Must I have an account for him on my machine if I want to
give him permissions?

He has a Win98SE. I have a WinXPProSP1. I have Simple
File Sharing disabled, and my Security model is set to
Classic - local users authenticate as themselves. Our
network is peer-to-peer, and I have my IP Config set so
we can use ICS, (and it works).

Windows IP Configuration
Host Name . . . . . . . . . . . . : ThinkCentre
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Wireless Network Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : NETGEAR WG311
802.11g Wireless PCI Adapter
Physical Address. . . . . . . . . : 00-09-5B-97-
FA-B0
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :

PPP adapter Cumberland Technologies:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : WAN
(PPP/SLIP) Interface
Physical Address. . . . . . . . . : 00-53-45-00-
00-00
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 151.205.241.61
Subnet Mask . . . . . . . . . . . :
255.255.255.255
Default Gateway . . . . . . . . . : 151.205.241.61
DNS Servers . . . . . . . . . . . : 66.59.100.87
205.166.61.160
NetBIOS over Tcpip. . . . . . . . : Disabled

Barry,

To use workgroup authentication using Advanced File Sharing, to allow your son
network access to your computer, you have to have an account on both the share
host computer (your WinXP) and the share access computer (your son's Win98).
And you have to synchronise the passwords.

If you want to use Simple File Sharing, then you simply need to enable the Guest
account.

If you have a WinXP Pro computer, you can change the Local Security Policy to
identify your son's userid as only able to use your computer thru shares.

Go to Control Panel - Administrative Tools - Local Security Policy - Security
Settings - Local Policies - User Rights Assignment. Find policy "Deny logon
locally" and add your son's account to that policy.

This is a Win2000 article (which should apply to WinXP Pro also):
<http://www.microsoft.com/windows200...advanced/help/sag_seconceptsunrightsintro.htm>

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Barry]

-----Original Message-----


Barry,

To use workgroup authentication using Advanced File Sharing, to allow your son
network access to your computer, you have to have an account on both the share
host computer (your WinXP) and the share access computer

(your son's Win98).

Well, thanks. That's what I wanted to know.

And you have to synchronise the passwords.

Did that.

If you have a WinXP Pro computer, you can change the Local Security Policy to
identify your son's userid as only able to use your computer thru shares.

Go to Control Panel - Administrative Tools - Local Security Policy - Security
Settings - Local Policies - User Rights Assignment. Find policy "Deny logon
locally" and add your son's account to that policy.

Hey, that's neat! I did that just to learn how, (and then
undid it), and his name and picture didn't even show up
on my logon screen.

This is a Win2000 article (which should apply to WinXP Pro also):
<http://www.microsoft.com/windows2000/en/advanced/help/de

fault.asp?
url=/windows2000/en/advanced/help/sag_seconceptsunrightsin
tro.htm>

Thanks. I went there and read it. Twice.

Thanks again for your help,
Barry

 

[Barry]

-----Original Message-----


He does use your machine if he connects to shares on it across the network.


Yes, unless you want to enable Guest, which I don't

recommend.

Thanks for answer.

Just set up
the NTFS security properly so he can't get into stuff he isn't supposed to -
either locally or across the network.

Yes, I must learn how to do that. I'll post any
questions I have on that issue on the Security and
Administration newsgroup. I hope there's somebody like
you and Chuck there.

Thanks,
Barry

 

[Hans-Georg Michna]

Barry,

one little hint from the fence: walk to your son's computer and
test what you can access on your computer. It's easy to make a
little mistake.

You can also experiment by allowing and disallowing access, then
walking over and test.

And another little hint from the sidelines: I hope you are aware
that, assuming NTFS, your son always needs two access rights to
access any object on your computer:

a) the share access right,
b) the object (folder, file, printer) access right.

He always needs both to access anything.

Hans-Georg

 

[Chuck]

(your son's Win98).

Well, thanks. That's what I wanted to know.


Did that.


Hey, that's neat! I did that just to learn how, (and then
undid it), and his name and picture didn't even show up
on my logon screen.

fault.asp?
url=/windows2000/en/advanced/help/sag_seconceptsunrightsin
tro.htm>

Thanks. I went there and read it. Twice.

Thanks again for your help,
Barry

YW, Barry. Thanks for the feedback.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.