11 SHARING FILE SYSTEM RESOURCES Chapter 9

Chapter 9: SHARING FILE SYSTEM RESOURCES2 CHAPTER OVERVIEW  Create and manage file system shares and work with share permissions  Use NTFS file system permissions to control access to files  Manage file sharing using Internet Information Services (IIS)  Create and manage file system shares and work with share permissions  Use NTFS file system permissions to control access to files  Manage file sharing using Internet Information Services (IIS)

Chapter 9: SHARING FILE SYSTEM RESOURCES3 UNDERSTANDING PERMISSIONS  File system permissions  Share permissions  Active Directory permissions  Registry permissions  File system permissions  Share permissions  Active Directory permissions  Registry permissions

Chapter 9: SHARING FILE SYSTEM RESOURCES4 ACCESS CONTROL LISTS

Chapter 9: SHARING FILE SYSTEM RESOURCES5 PERMISSIONS

Chapter 9: SHARING FILE SYSTEM RESOURCES6 INHERITANCE  Allows permissions assigned at one folder to flow down to subsequent files and folders  Can be overridden by explicit permission assignment or inheritance blocking  Useful in reducing the number of permission assignments required  Allows permissions assigned at one folder to flow down to subsequent files and folders  Can be overridden by explicit permission assignment or inheritance blocking  Useful in reducing the number of permission assignments required

Chapter 9: SHARING FILE SYSTEM RESOURCES7 EFFECTIVE PERMISSIONS  Allowed permissions are cumulative.  Denied permissions override allowed permissions.  Explicit permissions take precedence over inherited permissions.  Allowed permissions are cumulative.  Denied permissions override allowed permissions.  Explicit permissions take precedence over inherited permissions.

Chapter 9: SHARING FILE SYSTEM RESOURCES8 SHARING FOLDERS

Chapter 9: SHARING FILE SYSTEM RESOURCES9 ADMINISTRATIVE SHARES

Chapter 9: SHARING FILE SYSTEM RESOURCES10 RESTRICTIONS ON CREATING FILE SYSTEM SHARES  On a domain controller: Administrators, Server Operators, Enterprise Admins, Domain Admins groups only  On a domain member server or workstation: Administrators, Server Operators, or Power Users groups only  On a workgroup or standalone computer: Administrators or Power Users groups only  On a domain controller: Administrators, Server Operators, Enterprise Admins, Domain Admins groups only  On a domain member server or workstation: Administrators, Server Operators, or Power Users groups only  On a workgroup or standalone computer: Administrators or Power Users groups only

Chapter 9: SHARING FILE SYSTEM RESOURCES11 CREATING A FILE SYSTEM SHARE USING WINDOWS EXPLORER

Chapter 9: SHARING FILE SYSTEM RESOURCES12 SHARING A VOLUME USING WINDOWS EXPLORER

Chapter 9: SHARING FILE SYSTEM RESOURCES13 CREATING A FILE SYSTEM SHARE USING THE SHARED FOLDERS SNAP-IN

Chapter 9: SHARING FILE SYSTEM RESOURCES14 CREATING A FILE SYSTEM SHARE USING NET.EXE  Allows shares to be created from a command line  Lets you configure permissions during creation  Lets you configure offline settings for the share  Allows shares to be created from a command line  Lets you configure permissions during creation  Lets you configure offline settings for the share

Chapter 9: SHARING FILE SYSTEM RESOURCES15 MANAGING SHARED FOLDERS

Chapter 9: SHARING FILE SYSTEM RESOURCES16 CONTROLLING OFFLINE STORAGE

Chapter 9: SHARING FILE SYSTEM RESOURCES17 PUBLISHING FILE SYSTEM SHARES IN ACTIVE DIRECTORY

Chapter 9: SHARING FILE SYSTEM RESOURCES18 MANAGING SHARE PERMISSIONS

Chapter 9: SHARING FILE SYSTEM RESOURCES19 USING SHARE PERMISSIONS  Limited scope Can be applied only to folders and only when connecting to the share.  Lack of flexibility Permissions applied to the share apply to all levels below.  No replication Share permissions are not replicated.  No resiliency Share permissions cannot be backed up or restored.  Limited scope Can be applied only to folders and only when connecting to the share.  Lack of flexibility Permissions applied to the share apply to all levels below.  No replication Share permissions are not replicated.  No resiliency Share permissions cannot be backed up or restored.

Chapter 9: SHARING FILE SYSTEM RESOURCES20 USING SHARE PERMISSIONS (continued)  Fragility Shares (and therefore share permissions) are lost when a folder is moved or renamed.  No auditing Share permissions do not facilitate auditing.  Fragility Shares (and therefore share permissions) are lost when a folder is moved or renamed.  No auditing Share permissions do not facilitate auditing.

Chapter 9: SHARING FILE SYSTEM RESOURCES21 SHARE PERMISSION DEFAULTS  When a new share is created, the following permissions are granted:  Everyone special identity: Read  Administrators: Full Control  When a new share is created, the following permissions are granted:  Everyone special identity: Read  Administrators: Full Control

Chapter 9: SHARING FILE SYSTEM RESOURCES22 CREATING A FILE SYSTEM SHARING STRATEGY  Create logically named shares.  Use nesting where necessary to reduce users’ need to navigate the directory structure.  Share removable drives from the root to keep the share available when media are removed and reconnected or changed.  Create logically named shares.  Use nesting where necessary to reduce users’ need to navigate the directory structure.  Share removable drives from the root to keep the share available when media are removed and reconnected or changed.

Chapter 9: SHARING FILE SYSTEM RESOURCES23 NESTING SHARES  A share can be created on any folder in the file system.  Multiple shares on the same folder can have different permissions.  Permissions are applied at the share entry point.  A share can be created on any folder in the file system.  Multiple shares on the same folder can have different permissions.  Permissions are applied at the share entry point.

Chapter 9: SHARING FILE SYSTEM RESOURCES24 USING NTFS PERMISSIONS  Scope NTFS permissions apply no matter how the file is accessed.  Flexibility Wide range of permissions allows assignments to be tailored.  Replication NTFS permissions are included when a file is replicated.  Resilience NTFS permissions are retained when objects are backed up.  Less fragile NTFS permissions are not lost if a file is moved or renamed.  Auditing NTFS permissions support auditing.  Scope NTFS permissions apply no matter how the file is accessed.  Flexibility Wide range of permissions allows assignments to be tailored.  Replication NTFS permissions are included when a file is replicated.  Resilience NTFS permissions are retained when objects are backed up.  Less fragile NTFS permissions are not lost if a file is moved or renamed.  Auditing NTFS permissions support auditing.

Chapter 9: SHARING FILE SYSTEM RESOURCES25 MANAGING STANDARD PERMISSIONS

Chapter 9: SHARING FILE SYSTEM RESOURCES26 USING ADVANCED SECURITY SETTINGS

Chapter 9: SHARING FILE SYSTEM RESOURCES27 MANAGING SPECIAL PERMISSIONS

Chapter 9: SHARING FILE SYSTEM RESOURCES28 VIEWING EFFECTIVE PERMISSIONS

Chapter 9: SHARING FILE SYSTEM RESOURCES29 RESOURCE OWNERSHIP  Each file and folder is assigned an owner.  Ownership of a file makes the security principle a member of the Creator/Owner special identity.  Files that are owned go toward disk quota calculations.  Each file and folder is assigned an owner.  Ownership of a file makes the security principle a member of the Creator/Owner special identity.  Files that are owned go toward disk quota calculations.

Chapter 9: SHARING FILE SYSTEM RESOURCES30 ADMINISTERING IIS  Web server platform included with all editions of Windows Server  Version 6 has improved security over previous versions.  Allows files to be published through a browser interface.  Supports HTTP and FTP.  Web server platform included with all editions of Windows Server  Version 6 has improved security over previous versions.  Allows files to be published through a browser interface.  Supports HTTP and FTP.

Chapter 9: SHARING FILE SYSTEM RESOURCES31 INSTALLING IIS  Not installed during operating system installation  Installed through the Windows Components Wizard (select Add Or Remove Programs in Control Panel, and click Add/Remove Windows Components) or through the Manage Your Server wizard  Not installed during operating system installation  Installed through the Windows Components Wizard (select Add Or Remove Programs in Control Panel, and click Add/Remove Windows Components) or through the Manage Your Server wizard

Chapter 9: SHARING FILE SYSTEM RESOURCES32 MANAGING AN IIS WEB SITE

Chapter 9: SHARING FILE SYSTEM RESOURCES33 USING THE WEB SITE TAB

Chapter 9: SHARING FILE SYSTEM RESOURCES34 USING THE HOME DIRECTORY TAB

Chapter 9: SHARING FILE SYSTEM RESOURCES35 USING THE DOCUMENTS TAB

Chapter 9: SHARING FILE SYSTEM RESOURCES36 USING THE PERFORMANCE TAB

Chapter 9: SHARING FILE SYSTEM RESOURCES37 CREATING VIRTUAL DIRECTORIES  Allows you to include a folder from anywhere on the network in your Web site  Appears to the Web site user as if it is a sub- directory of the main Web site folder  Allows management of Web content to be distributed between departments.  Allows you to include a folder from anywhere on the network in your Web site  Appears to the Web site user as if it is a sub- directory of the main Web site folder  Allows management of Web content to be distributed between departments.

Chapter 9: SHARING FILE SYSTEM RESOURCES38 CONFIGURING IIS SECURITY

Chapter 9: SHARING FILE SYSTEM RESOURCES39 CONFIGURING IIS AUTHENTICATION

Chapter 9: SHARING FILE SYSTEM RESOURCES40 CONFIGURING IP ADDRESS AND DOMAIN NAME RESTRICTIONS

Chapter 9: SHARING FILE SYSTEM RESOURCES41 CONFIGURING SECURE COMMUNICATIONS

Chapter 9: SHARING FILE SYSTEM RESOURCES42 SUMMARY  Windows Server 2003 controls access to resources using a number of mechanisms, including share permissions and NTFS permissions.  Every object protected by permissions has an ACL, which is a list of ACEs assigned to that object. Each ACE contains a security principal and indicates the level of access they are permitted or denied to the object.  File system shares enable network users to access files and folders on other computers.  Windows Server 2003 controls access to resources using a number of mechanisms, including share permissions and NTFS permissions.  Every object protected by permissions has an ACL, which is a list of ACEs assigned to that object. Each ACE contains a security principal and indicates the level of access they are permitted or denied to the object.  File system shares enable network users to access files and folders on other computers.

Chapter 9: SHARING FILE SYSTEM RESOURCES43 SUMMARY (continued)  Share permissions provide basic protection for file system shares, but they lack the granularity and flexibility of NTFS permissions.  NTFS permissions can be allowed or denied, and explicit or inherited. A Deny permission takes precedence over an Allow permission, and an explicit permission takes precedence over an inherited permission.  Share permissions provide basic protection for file system shares, but they lack the granularity and flexibility of NTFS permissions.  NTFS permissions can be allowed or denied, and explicit or inherited. A Deny permission takes precedence over an Allow permission, and an explicit permission takes precedence over an inherited permission.

Chapter 9: SHARING FILE SYSTEM RESOURCES44 SUMMARY (continued)  Access granted by NTFS permissions can be restricted by share permissions and other factors, such as IIS permissions on Web sites.  Whenever two permission types are assigned to a resource, you must evaluate each set of permissions and then determine which of the two is more restrictive.  Every NTFS file and folder has an owner. The owner of a file or folder is always permitted to modify the file or folder’s ACL.  Access granted by NTFS permissions can be restricted by share permissions and other factors, such as IIS permissions on Web sites.  Whenever two permission types are assigned to a resource, you must evaluate each set of permissions and then determine which of the two is more restrictive.  Every NTFS file and folder has an owner. The owner of a file or folder is always permitted to modify the file or folder’s ACL.

Chapter 9: SHARING FILE SYSTEM RESOURCES45 SUMMARY (continued)  Any user with the Allow Take Ownership permission or the Take Ownership Of Files Or Other Objects user right can take ownership of an object.  IIS is a Windows Server 2003 application that allows you to share files and folders using Web and FTP server services.  Any user with the Allow Take Ownership permission or the Take Ownership Of Files Or Other Objects user right can take ownership of an object.  IIS is a Windows Server 2003 application that allows you to share files and folders using Web and FTP server services.