Sharing folders in My Documents
In this example, we cover the situation where you need to consider
NTFS permissions as well as share permissions.
The situation described here will only occur if either of the following
conditions is true:
- You created the user accounts as Limited accounts;
- You've previously used Simple File Sharing to mark My
Documents as Private.
In either of these cases, you'll run into NTFS permission problems.
However, if you created the user accounts as Administrator
accounts, and the My Documents folder has not been marked
as Private, then no further action is necessary, since Administrators
have NTFS access to default (non-Private) My Documents
We're logged on to the XP machine as Ron and wish to share
the My Documents folder across the network to the girls,
Iona and Catriona.
I use Windows Explorer, browse to My Documents, right-click,
and look for Sharing and Security. It's missing! Presumably,
you're only expected to share sub-folders of My Documents.
The option is present on My Music, My Pictures etc.
If you really want to share the whole My Documents folder,
you still can: right-click it and select Properties to see
the Sharing and Security tabs.
We give it a share name (names containing blanks can cause problems,
so we've made it My-Documents). In the Permissions
button, we add Iona and Catriona with Read
and Change permission, and remove everyone, as before.
Now to test it!
- We log on to a client PC as Iona.
- We can browse Network Neighbourhood.
- We can browse the XP computer;
- We have access to Girlstuff, as expected.
- We have Access Denied to Boystuff, as expected.
But when we try to access My-Documents, we get an error
What happened? We gave Iona permissions to access the share,
so why was she was not allowed?
Remember about network user having to get past both gatekeepers?
Well, Iona got past the share permissions level, only to
be blocked at the NTFS permissions level.
Remember also that XP Professional sets up NTFS permissions on
the My Documents folder and that we created the users as
Limited accounts, not Administrator accounts.
Let's go back and fix it. We use Windows Explorer, browse to My
Documents, right-click it, and select Properties. This
time, we choose the Security tab. Notice how ONLY Administrators
and the Owner have any permissions!
To fix this issue, we need to either:
- Change the user accounts to Administrator accounts.
This will add the user to the Administrator group and resolve
the issue. Notice that this will not work if we've previously
used Simple File Sharing to mark My Documents as
Private. If you refer to the matrix in the Microsoft Knowledge
Base article Description
of File Sharing and Permissions in Windows XP, you'll
see that this removes Administrator' from the NTFS permissions.
- Change the NTFS permissions to explicitly permit the desired
users or groups.
take the second approach. Use the Add button to add the
users or groups that should have access to the shared folder. We
could choose to add the group USERS, or we could add individual
users. In this case, we'll add just the individual users Iona
and Catriona, and we need to explicitly add Write
Now, when Iona tries to gain access to the share across
network, there's no problem:
That concludes our fairly exhaustive tour of XP Professional
sharing and NTFS security.