How to block one computer from LAN without blocking everyone else

[Devoldo]

I'm running a pretty simple LAN network. I have a D-link DGL-4500 and about 2 computers running constantly on the WORKGROUP network (plus an old D-link router that I disabled the DHCP server on to run as a switch for my PS3 and Xbox). I want to share two certain folders with anyone that brings their computer over, but block my roommate from being able to access these folders. When I turn on Password Protected Sharing, anyone that comes over is prompted for a username and password, and instead of giving them the info each time, I would love to simply block my roommates computer alone. Something like \\VENTO is an exception to the everyone full access rule.

I have my A+ certification, but permissions and such in windows 7 is a little new to me and haven't had a lot of time to fiddle with advanced network options (still trying to memorize the address range to the different classes...Anyone have a rhyming scheme?) . So any complex jargon you may have I can comprehend

Both my roommate and myself are running windows 7 ultimate. Any help is appreciated.

 

[Barman58]

If you remove the permissions from "Everyone" on the individual folders and add individual permissions at which ever level you wish, to each user account that you wish to have access, that should do the trick.

Workgroup networking does not use the computer object as is used in a domain so all permissions are user based.

You could also create a new user group and give this the permissions you need then assign the allowed user to this group - how you go depends on what variation of accessibility you need for your users

 

[Devoldo]

If you remove the permissions from "Everyone" on the individual folders and add individual permissions at which ever level you wish, to each user account that you wish to have access, that should do the trick.

Workgroup networking does not use the computer object as is used in a domain so all permissions are user based.

You could also create a new user group and give this the permissions you need then assign the allowed user to this group - how you go depends on what variation of accessibility you need for your users

Thats the problem though, I really didn't want to set up permissions for each user. I have random people that drop by with their computers and different OS's and accounts, and if there was some way to simply block my roommate's computer by its name, adding him to the exception of the everyone permission, then I would be a happy camper.

Basically the permissions I want is full control of those folders, so each person that comes by can drop movies and music and etc. into said folders, and pull other files out as they please. I cannot express how hard the route you are talking about will be since some of my less computer-savvy friends have no idea what to do when it asks for a password (not to mention some of them are very paranoid about someone like me going through their computer, ha.) I have certain files automatically download into these folders and to copy them onto my public folder is impossible since these two folders are shared on 2 2TB drives.

I tried to resolve this by buying a NAS and setting up an exception for his local IP, but the transfer speed even at gigabit speeds was a measly 9MB/sec from this particular NAS (don't buy a cheap D-Link NAS).

Is there no other way you could think of setting up the permission with this scenario? I was always told Windows file sharing is kind of a joke compared to other OS's, but I didnt think it was this borked

 

[Barman58]

Does your room mate have an account on your system that he/she uses to access it?

If so you can use the deny option to block that user specifically - as the Deny overrides all other permissions be careful to only apply it where it is needed.

One other way would be to create a user specifically for this task remove the everyone access to the folders give this user access and give this information to others on an ad-hoc basis (but not to your room mate)

 

[Barman58]

Just had a further thought - Comodo's firewall has an option to set-up a blocked network - this can consist of a single IP or better still MAC address

this may work ? it means more software but Comodo firewall is a good thing in general anyway

 

[Devoldo]

Does your room mate have an account on your system that he/she uses to access it?

If so you can use the deny option to block that user specifically - as the Deny overrides all other permissions be careful to only apply it where it is needed.

One other way would be to create a user specifically for this task remove the everyone access to the folders give this user access and give this information to others on an ad-hoc basis (but not to your room mate)

Now thats an option that I completely forgot about. Two days without sleep will do that...No Im not trying to excuse my stupidity

I will try to find out his username account and see if I can get him blocked. I wish there was a search function that would pop up all users who are currently sharing public folders and allow me to select a user from that list like so:

http://img541.imageshack.us/i/capturexb.jpg/

But when searching for users outside of my computer since locations only shows:

http://img838.imageshack.us/i/capture2t.jpg/

I'll reply back to see if I can find a solution to this dilemma; thanks again for your help barman58

 

[Barman58]

There is the shared files section of the Computer Management interface that shows shares, sessions, and files status

 

[nickiler]

One other way would be to create a user specifically for this task remove the everyone access to the folders give this user access and give this information to others on an ad-hoc basis (but not to your room mate)

I wanted to "second" this option as I think it would be simple and effective. Your friends can try to connect and you can have a simple user named "access" with a password.

Does your roommate access anything on your computer? Why not create a separate subnet? I think you can block him completely from your system.

 

[tezlewis]

Put there MAC address into the router for blocking under MAC address filtering.

 

[chev65]

This is an age old problem and it's not easily solved.

With Windows 7 it's best to create a restricted user group then add the users you don't want to have access to that group. It's explained pretty well in the link below.
http://www.sevenforums.com/network-...rotect-directories-childrn-other-usrs-pc.html

 

[TooCrooked]

what an intriguing question! since you were using the name, i figured you could intentionally screw up netbios name resolution by adding your roomate's computer name to your LMHOSTS file and pointing it to 127.0.0.1... however, in my tests, it didn't matter. besides, this wouldn't help you if he connected based on your IP address.

if you control your router that your roommate connects to, and he doesn't have your password, you can set a DHCP reservation for his MAC address. then, set it to some IP that you'd block in your firewall. but if he knows networking, all he'd have to do is statically set an address on his box... if you had some super funky subnet mask, it would be harder for him to guess at a valid address, but even that's a long shot.

i was also going to suggest using ARP to force his MAC address to go to an invalid address on your PC (to intentionally confuse networking), but the problem is that you can have a single MAC pointing to multiple addresses. even if you delete the current instance, once you do any netbios broadcast, your ARP table gets rebuilt.

if there were a firewall app you could download that could block based on a MAC, you'd be set.

 

[Devoldo]

Thank you guys for the responses! I sincerely did try and google this problem before bothering anyone on this forum, but google turned up nothing (probably my wording...). I did exactly what barman58 said and set up a username and password specifically to give out to people that randomly drop by my house. While my roommate isn't a computer geek such as ourselves , I'm sure he would have tried to find a way to get into my stuff again.

The router I have is a pretty amazing thing, I had no idea the amount of options this thing is packed with, I mean it even does its own brute-force speed test once rebooted. I may try and play around with that later to see about blocking his mac address, and since I am a nosey person... I decided to sign up for http://openDNS.org and block a couple websites I know hes been going to. Lets just say I do not need the cops banging on my door for his...Illegal activities. Hopefully this will be a temporary fix until I can convince someone else to move in and kick this little pest out.

Thanks again for the replies guys! With what knowledge I have I'll attempt to help some others out on this forum as well. Who knows, a stubborn person like me may learn a thing or two

 

[Barman58]

if there were a firewall app you could download that could block based on a MAC, you'd be set.

Just in case you ever need this Comodo Firewall will allow you to set this up based on the MAC address which would allow you to block a specific NIC from access to a machine whilst still allowing them internet access and allowing others access.

I can see an advantage in this where the router is shared and subnets set by others

 

[chev65]

The guide I posted is in fact the only way to accomplish this. It's not too difficult to set up if you try.

 

[ZugZug]

Answered

WAY OLD REPLY but for those still looking..
Open the advanced firewall configuration. In the left panel, choose Inbound or Outbound rules.

1. Click New rule in the right panel.

2. Choose Custom.

3. In the left, go to "Scope." Choose “These IP addresses”, click Add button and add the IP range.

4. Go to Action, choose Block the connection.

Hope it helps.