Win 7 Pro file server with network shares - is this method secure?

Hello all,

We have a Windows 7 Pro computer in an unsecure room acting as a file server to 10 other computers on the network.

My issue is with creating and securing network shared folders so that prying eyes can not access info not meant for them.

We currently have 3 folders to share with different departments. These folders are 'Accounting', 'Design', and 'Production'.

As mentioned there are 10 other computers on the network and user accounts have been created on the file server to match the user accounts on each of the 10 computers. For these 10 user accounts on the file server, we did however set up the users with passwords that are different than the password used on their own computer. This was done to prevent anyone from logging into the file server and messing with it.

The method I am considering for sharing the 'Accounting', 'Design', and 'Production' folders is to share each folder on the file server and to add 'Everyone' as a user, granting access to all 10 users on the network. To limit access to any particular user, via the 'Security' tab on the shared folder, I press the edit button and add the user. Then all their permissions are set to deny. I would add more users I wish to deny access in the same way.

It seems to work fine. Mapping a network drive to the file server is allowed only by users not denied for the particular share and a password is not required to map to the share.

Is there any security risk to doing it this way or any downside I may encounter?

Thanks for any help.

TV

Yes as Tanya says it's safer if you can remove the Everyone share. The directions for adding users to groups and removing the Everyone share is explained in the following link.

This link has the best explanation for NTFS file sharing that I've found.
Share Permissions and NTFS Permissions Folder Access Control & Folder Permissions - AD and Exchange Quantum Singularity

Thank you Tanya for the in depth explanation. I had a feeling my approach was not ideal.

Thank you Chev for the link.

I came about the proposed solution because I had trouble mapping shared drives. As mentioned 10 users were set up on the Win 7 Pro file server that matched the 10 user names of the other 10 computers on the network. Since the file server is not in a secure location, it was decided to use different passwords for the 10 accounts on the file server than the passwords being used on to log on at each of the 10 computers, thus preventing any of the 10 users access to the file server.

Although I have mapped network drives many times before, I was not able to map a network drive in this case. Many combinations were tried but none worked.

Is it that I did not get the right combination of credentials/password or is it that the different password for users on the file server did not allow for it to work? I tried a similar approach with a Linux file server and it worked fine and I'm guessing I'm entering the credentials/password incorrectly on this Windows file server.

The windows file server is called 'SERVER' and has an 'ADMIN' account + the 10 other accounts on it, let's say user1, user2,... , user10.

After browsing the share, what would be the correct credentials to use to map the network drive? Would I need to 'Connect using different credentials'? Please note that I did allow permissions for the particular user under the security tab for the share.

Thank you once again for your help.

TV

Well it turns out that the file server did not have 'Turn on password protected sharing' switched on and that was the problem. Everything works fine now.

When user1 is granted access to two shares from the file server, typing in the credentials once gives access to both shares. Is this normal behaviour or is there a way to force credentials to be entered for each network mapped drive even if they originate from the same file server?

Thanks,

TV

tv69 said:

We have a Windows 7 Pro computer in an unsecure room acting as a file server

That's all I need to read to see that you're against an impossible challenge. Physical security is number one priority in securing any server, because "the bad guys" can do literally anything to it when having physical access (which is FAR more powerful than administrator access).
The very first thing you need to do is to find a safe place to put it, under a lock at the very least. If anyone can walk in and use its keyboard/mouse/screen, they can login directly there, put disks and copy data, remove backup devices with all their data, or simply reboot with an external OS and bypass any security you can come with. A good reading on the matter is this:
Ten Immutable Laws Of Security (Version 2.0)
"Law 3" specifically.

tv69 said:

it was decided to use different passwords for the 10 accounts on the file server than the passwords being used on to log on at each of the 10 computers, thus preventing any of the 10 users access to the file server.

I will have to say no again . This is actually counterproductive. Because of the way Windows shares work, a valid login for the share is also a valid login to the computer it's stored in. By using a different credentials, you only prevent them from using the very same password as they use on their computers, but they can still use the alternative one to login into the server, as they're doing to access the shares.

A better solution is to have the same password on both places. This is easier for the users to remember and more practical (less post-it's with passwords is also more secure) and straightforward to use. But to actually prevent any login into the server from the users, you can use a gpedit policy, located in:
Computer Configuration => Windows Settings => Security Settings => Local Policies => User Rights Assignment => Deny logon locally. Add your 10 users there, so they can't use their credentials to login as a normal user. Also, keep them out of the Terminal Server group, so they can't even use remote desktop to it. This still allows to use the shares though the network.

For everything else, I just agree with TanyaC and chev65. Grant the bare minimum permissions to get the job done, when in doubt, deny until someone complains.
One more thing. Since you have an insecure location, make sure you encrypt the backups, so when someone steals them, they'll have a hard time getting any data out of them.

Alejandro85,

I really appreciate the response and your point of view. I have raised the point of the unsecure room to the owners and it will eventually be taken care of. There is probably one person in the building that may have the technical know how to cause some damage. It's not justification for an unsecure room but I agree that it is a bigger problem than passwords and user names.

Thank you also for the link to the 10 Immutable laws.

I don't quite understand you explanation of why it is bad to have user accounts on the server with different passwords than what are used by the users to log in to their own computers?

Each user logs into their user account on their computer with their local password. Network shares with different user credentials are going to be set up by admin only, not the users themselves.

I will look at the gpedit you suggested and the locking out of terminal services as well.

I'm still curious about this from my previous post.
When user1 is granted access to two shares from the file server, typing in the credentials once gives access to both shares. Is this normal behaviour or is there a way to force credentials to be entered for each network mapped drive even if they originate from the same file server?

Thank you for your input, much appreciated.

TV

TanyaC said:

tv69 said:

When user1 is granted access to two shares from the file server, typing in the credentials once gives access to both shares. Is this normal behavior or is there a way to force credentials to be entered for each network mapped drive even if they originate from the same file server?
TV

Yes, the permissions you give are based on the user (or more specifically, the SID associated with the user). Remember, the password is associated with the user account, not with the share.

So, once a user logs in and is authenticated, they will get access to anything you have given them explicit access to.

To grant permissions to a specific user grant that user permissions to the share (Don't use everyone or the "users" group). Then grant specific allow permissions for what you want to do with the data managed by that share (Files and folders).

So, if you have two shares: "Accounts" and "Sales". Fred is a member of accounts, and sue is a member of sales, then you would grant fred access to the accounts share and not to sales, and Sue would be the reverse.

As to the second part of your question; As I said, the credentials apply to the user. They do not apply to the objects on the server. This is managed by the security, or what we call "Access Control Lists".

As long as you get your security correct it shouldn't be a problem.

If users share PCs you will need to have stringent log out policies and potentially automate some of that.

hth
tanya

Ah thank you Tanya. I was typing my post to Alejandro as you were typing your response. I took your good advice, tested it out and it all seems to work fine. Don't use 'Everyone' and only grant access to those needing it. Next I will sort out some user groups to simplify the process of sharing.

All of you have been most helpful.

Cheers,

TV