Windows XP Professional File Sharing
The file system in Windows XP is based on Windows NT and Windows 2000, so many of its features are new to users of Windows 95, 98, and Me. In this article, we'll show you how to set up your Windows XP Professional computer to share its disks and folders with other Windows computers on a network, give access to desired users, and keep other users out.
In Windows 95/98/Me, you can assign a password to a shared disk or folder, so that only people who know the password can gain access. That works well in a small home network where, for example, Mom and Dad know the password to the family's financial data, but Junior doesn't. But it isn't practical in a large corporate network, where Windows XP Professional is likely to be used. It's hard to keep a password secret in a large company, and changing to a new password requires giving it to everyone who needs to use it.
Windows XP Professional replaces password-based security with two alternatives:
Simple File Sharing is enabled by default on Windows XP Professional systems that are members of a workgroup (typically used in small networks) rather than a domain (typically used in large corporate networks). For full details, see our article on Simple File Sharing. There are no passwords or access restrictions and, with one exception described in the article, everything that's shared is accessible by everyone on the network. Simple File Sharing is the only type of sharing available in Windows XP Home Edition.
By disabling Simple File Sharing, you can specify an Access Control List (ACL) for each shared disk or folder. The ACL specifies which users are allowed to have access.
We'll show you how to configure Windows XP Professional to:
Disable Simple File Sharing for increased security and control;
Create user accounts and user groups;
Share a disk or folder;
Set up Access Control Lists;
Allow network access by users without passwords.
To illustrate the concepts, we'll:
Create user accounts for four people: Alasdair, Fraser, Iona , and Catriona;
Create shared folders called Girlstuff, Boystuff, and Kidstuff, which will allow different levels of access to different people. Boystuff will be accessible to Alasdair and Fraser, Girlstuff will be accessible to Iona and Catriona, and Kidstuff will accessible to them all;
See how the users access the shared folders.
Finally, we'll show you how to access Windows XP Professional's shared disks and folders from another client computer on the network, adding some information about file permissions in the NTFS file system, and giving solutions for some common network access problems
User Accounts: Password or No Password?
By default, a user account is created with no password. This means the user may sit down locally at the XP machine and log on without entering a password.
However, by default, Windows XP will not permit a network user to access the XP machine using an account set up without a password!
You have two options on how to proceed from here:
If you want any degree of security, assign user passwords. This will, however, require the users to log on to their client machines using a password.
Many people prefer to set up their Windows 95/98/Me machines using Windows Logon and no password, so the machine boots directly to the Windows desktop without a logon prompt. In this case, you need to make a Security Policy modification on the XP Professional machine to permit users without passwords to connect from the network.
Taking each option in turn:
Adding a Password to a User Account
In Control Panel | User Accounts, click the desired account, and then click Create a password. Enter the password, and then enter it again to confirm it. Enter a password hint if you'd like – a user who forgets the password can look at the hint at the logon screen as a memory aid. Then click Create Password to make it take effect.
In the User Accounts menu in Control Panel, the user account now shows as being Password protected:
The user must now log on to his or her local computer using that password.
Permitting Network Access Without a Password
To allow users to log onto their computers without a password and then access the XP Professional machine without a password, you must make a security policy change:
Go to Control Panel | Performance and Maintenance | Administrative Tools | Local Security Policy.
Expand Local Policies | Security Options.
Double-click Accounts: Limit local account use of blank passwords to console login only, which is enabled by default. Disable this option and click OK.
This will permit network access without a password. The user's computer can boot directly to the Windows desktop, and be validated against the corresponding XP Professional user account, without a password.
Note that the term “blank passwords” isn't technically accurate. There's a difference between having a password which consists of one or more blank characters, and having no password at all. This setting actually permits access by users who have no password at all.
Power User Tip: If you want to explore user accounts in the raw:
Click Start | Control Panel | Performance and Maintenance | Administrative Tools | Computer Management.
Open the Local Users and Groups folder, and open the Users folder.
Here are your user accounts! You can fine-tune their settings from here or create new users using the Action | New User menu option!
Set Up Access Control Lists on the Shares
Click Permissions. Notice how, by default, the Everyone group has Full Control. This means that all users can read, write, and even delete files. That's not what we want at all!
To change the share permissions:
Click Add, and then choose Object Types.
Un-check Built-in security principles and Groups, because we only want to see Users.
Click OK. From this location should show the name of your computer.
Choose Advanced, and click Find Now.
Click on the users who should have access this share.
Power User Tip: Ctrl-Click allows you to make multiple selections!
Click OK, and the users are added:
You may repeat this to add additional users. When done, click OK.
You're now back at the ACL editor. By default, the newly-added users have read-only access. If you want them to have read/write access, then tick the Change box. You need to do this for each user! Select each user in the list in turn, and specify Change permission. Don't give limited users Full Control.
To prevent Guest access to this share, we must remove the Everyone group! Select it, and click Remove.
The ACL is now as we want it: Boystuff is only accessible by Alasdair and Fraser. Click OK to close the ACL permissions window.
Then click OK to close the share properties. Now, only the specified users can access the shared folder!
Right-click the Girlstuff folder, then repeat the procedure above to give Iona and Catriona Change permission for the share. Remember to remove the Everyone group!
Finally, right-click the Kidstuff folder, and repeat the procedure to give all the kids Change permission for the share. Again, remember to remove the Everyone group.
The share permissions are now set up on the XP Professional machine.
Create Shares
In this example, we've used Windows Explorer to browse to the root directory of the C: drive. In the right-hand pane, we right-click, select New | Folder, and enter the name Boystuff. Similarly, we create folders called Girlstuff and Kidstuff.
To specify sharing options for the Boystuff folder:
Right-click the folder and select Sharing and Security.
On the Sharing tab, select Share this folder and enter a share name.
Add a comment if desired. This comment describes the share and appears in My Network Places on other computers.
Leave the User limit alone. On XP professional, the maximum limit is 10
Disable Simple File Sharing
Disabling Simple File Sharing is necessary in order to enable the creation of Access Control Lists for shared disks and folders:
Click Start | My Computer | Tools | Folder Options | View.
Scroll to the bottom of the list of advanced settings and un-check Use Simple File Sharing (Recommended).
Click OK.