Want to share files one-way only

[Shagbark]

There are lots of people asking for help when they have two computers that will share files in one direction but not the other. I have two computers that share files in both directions, but I want it to be only in one direction.

One computer, running Windows 7, is my Internet computer, and the computer that will get infected or attacked if I run into nasties online. The other, running Windows 10, is my compute server, for running massive computations, and also for backing up my Win 7 computer's drives. I want the Windows 10 computer to be able to copy files from the Win 7 computer, but I don't want an attacker that takes over the Win 7 computer to be able to delete, modify, or encrypt files on the Win 10 computer.

I know that I can simply not share any directories on the Win 10 computer, but to be safer, I don't want it even to accept incoming connections from the Win 7 computer.

I think I could set this up if I knew what "turn on file and printer sharing" does. but I can't find any info on what goes on under the hood when you press that button, other than that it creates a new firewall rule.

 

[Shagbark]

I found in Windows 10, under Security > Firewall & network protection > Domain network, a setting "Incoming connections: Prevents incoming connections when on a domain network". I can check that, and then still copy files back and forth from the Windows 10 machine. Is that a sufficient solution, do you all think?

 

[samuria]

Remember by default all drives are shared with an admin share is c$ the weakness with your plan is if you connect to 7 and copy files any virus could be copied

 

[Alejandro85]

I know that I can simply not share any directories on the Win 10 computer, but to be safer, I don't want it even to accept incoming connections from the Win 7 computer.

It's that simple as that. Sharing is always one-way, controlled by the sharing computer (who also control what others can do with those files).
Not accept incoming connections is as simple as disabling the relevant services. In case of the standard SMB shares, just stop the "server" service and you're done. Other file sharing tools may be present according to your setup, so be sure to secure those too.
Of course, this has the side-effect of preventing all sharing from the Win10 computer, including other unrelated folders, printers and some forms of IPC too. Personally, I would share the backup folders, as read-only with strict permissions and strong passwords. Not sharing them at all is another good choice.

Remember by default all drives are shared with an admin share is c$ the weakness with your plan is if you connect to 7 and copy files any virus could be copied

This is indeed a serious vulnerability present by default in all versions of Windows, but to exploit it the attacker must know an admin password. As far as I understood, he's using the pull model for the backups, so 10 will connect to 7, so no shares are needed on the backup computer.
But even if these were open, all they can do is to drop files on the computer. Remember that a virus is totally harmless if not actually executed, just like any other program.