The file system in Windows XP is based on Windows NT and Windows 2000, so many of its features are new to users of Windows 95, 98, and Me.\u00a0 In this article, we’ll show you how to set up your Windows XP Professional computer to share its disks and folders with other Windows computers on a network, give access to desired users, and keep other users out.<\/p>\n
In Windows 95\/98\/Me, you can assign a password to a shared disk or folder, so that only people who know the password can gain access. That works well in a small home network where, for example, Mom and Dad know the password to the family’s financial data, but Junior doesn’t.\u00a0 But it isn’t practical in a large corporate network, where Windows XP Professional is likely to be used.\u00a0 It’s hard to keep a password secret in a large company, and changing to a new password requires giving it to everyone who needs to use it.<\/p>\n
Windows XP Professional replaces password-based security with two alternatives:<\/p>\n
We’ll show you how to configure Windows XP Professional to:<\/p>\n
To illustrate the concepts, we’ll:<\/p>\n
Finally, we’ll show you how to access Windows XP Professional’s shared disks and folders from another computer on the network, adding some information about file permissions in the NTFS file system, and giving solutions for some common network access problems.<\/p>\n
Disabling Simple File Sharing is necessary in order to enable the creation of Access Control Lists for shared disks and folders:<\/p>\n
There are a couple of ways to do this, but let’s start simply by clicking\u00a0Start\u00a0<\/i>|\u00a0Control Panel\u00a0<\/i>|\u00a0User Accounts<\/i>. We describe a more comprehensive method later.<\/p>\n
You’ll see all of the existing accounts on the computer. You probably created these when you installed Windows XP. You’ll also see the\u00a0Guest<\/i>\u00a0account. It may or may not be enabled, depending on whether you have previously enabled Simple File Sharing.<\/p>\n
Click\u00a0Create a new account<\/i>, and enter the new user’s name.\u00a0 Here, we’re creating an account for Alasdair:<\/p>\n
Click\u00a0Next<\/i>, and choose the account type. This determines (rather simplistically) which group the user will be placed in. There’s generally no good reason to grant remote users\u00a0Computer administrator<\/i>\u00a0privileges, so select\u00a0Limited<\/i>, and then click\u00a0Create Account<\/i>. The new account appears in the\u00a0User Accounts<\/i>\u00a0window.<\/p>\n
Repeat as required\u00a0until<\/span>\u00a0all of the desired user accounts are created.<\/p>\n By default, a user account is created with no password.\u00a0 This means the user may sit down locally at the XP machine and log on without entering a password.<\/p>\n However, by default, Windows XP will not permit a network user to access the XP machine using an account set up without a password!<\/i><\/b><\/p>\n You have two options on how to proceed from here:<\/p>\n Taking each option in turn:<\/p>\n Adding a Password to a User Account<\/b><\/p>\n In\u00a0Control Panel<\/i>\u00a0| User Accounts<\/i>, click the desired account, and then click\u00a0Create a password<\/i>.\u00a0 Enter the password, and then enter it again to confirm it.\u00a0 Enter a\u00a0password hint<\/i>\u00a0if you’d like \u2013 a user who forgets the password can look at the hint at the logon screen as a memory aid. Then click\u00a0Create Password<\/i>\u00a0to make it take effect.<\/p>\n In the User Accounts<\/i>\u00a0menu in\u00a0Control Panel<\/i>, the user account now shows as being Password protected:<\/p>\n The user must now log on to his or her local computer using that password.<\/p>\n Permitting Network Access Without a Password<\/b><\/p>\n To allow users to log onto their computers without a password and then access the XP Professional machine without a password, you must make a security policy change:<\/p>\n <\/p>\n This will permit network access without a password. The user’s computer can boot directly to the Windows desktop, and be validated against the corresponding XP Professional user account, without a password.<\/p>\n Note that the term \u201cblank passwords\u201d isn’t technically accurate.\u00a0 There’s a difference between having a password which consists of one or more blank characters, and having no password at all.\u00a0 This setting actually permits access by users who have no password at all.<\/p>\n Power User Tip<\/span>:<\/i><\/b>\u00a0If you want to explore user accounts in the raw:<\/p>\n Here are your user accounts! You can fine-tune their settings from here or create new users using the Action<\/i>\u00a0|\u00a0New User<\/i>\u00a0menu option!<\/p>\n You may wish to group users together for administrative convenience. For example, a university might define groups of users called\u00a0Staff<\/i>\u00a0and\u00a0Students<\/i>.\u00a0 Settings that you make for a group automatically apply to all of the users in the group, so you don’t have to make the same settings individually for each user.<\/p>\n You can create as many groups as you like, include any number of users in each group, and include each user in any number of groups.\u00a0 Here’s an example of creating a new group:<\/p>\n Click\u00a0Create<\/i>\u00a0to create the new group.\u00a0 It can now be added to shares, the same way as individual users.<\/p>\n In this example, we’ve used Windows Explorer to browse to the root directory of the C: drive.\u00a0 In the right-hand pane, we right-click, select New<\/i>\u00a0|\u00a0Folder<\/i>, and enter the name\u00a0Boystuff<\/i>. Similarly, we create folders called\u00a0Girlstuff\u00a0<\/i>and\u00a0Kidstuff<\/i>.<\/p>\n <\/p>\n To specify sharing options for the\u00a0Boystuff<\/i>\u00a0folder:<\/p>\n <\/p>\n Click Permissions<\/i>.\u00a0 Notice how, by default, the\u00a0Everyone<\/i>\u00a0group has\u00a0Full Control<\/i>. This means that all users can read, write, and even delete files.\u00a0 That’s\u00a0not<\/b>\u00a0what we want at all!<\/p>\n To change the share permissions:<\/p>\n Power User Tip<\/span>:<\/i><\/b>\u00a0Ctrl-Click allows you to make multiple selections!<\/p>\n Click OK<\/i>, and the users are added:<\/p>\n You may repeat this to add additional users.\u00a0 When done, click\u00a0OK<\/i>.<\/p>\n You’re now back at the ACL editor.\u00a0 By default, the newly-added users have read-only access. If you want them to have read\/write access, then tick the\u00a0Change<\/i>\u00a0box. You need to do this for each user! Select each user in the list in turn, and specify\u00a0Change\u00a0<\/i>permission. Don’t give limited users\u00a0Full Control<\/i>.<\/p>\n To prevent\u00a0Guest<\/i>\u00a0access to this share, we must remove the\u00a0Everyone<\/i>\u00a0group!\u00a0 Select it, and click\u00a0Remove<\/i>.<\/p>\n The ACL is now as we want it:\u00a0Boystuff<\/i>\u00a0is only accessible by Alasdair and Fraser. Click\u00a0OK<\/i>\u00a0to close the ACL permissions window.<\/p>\n Then click\u00a0OK<\/i>\u00a0to close the share properties.\u00a0 Now, only the specified users can access the shared folder!<\/p>\n Right-click the\u00a0Girlstuff<\/i>\u00a0folder, then repeat the procedure above to give\u00a0Iona<\/i>\u00a0and\u00a0Catriona<\/i>\u00a0Change<\/i>\u00a0permission for the share. Remember to remove the\u00a0Everyone<\/i>\u00a0group!<\/p>\n Finally, right-click the\u00a0Kidstuff<\/i>\u00a0folder, and repeat the procedure to give all the kids\u00a0Change<\/i>\u00a0permission for the share. Again, remember to remove the\u00a0Everyone<\/i>\u00a0group.<\/p>\n The share permissions are now set up on the XP Professional machine!<\/p>\n The Access Control List is a tool for protecting network shares, but it doesn’t stop someone from walking up to the computer, logging in, and looking at the files on the computer. Share permission and ACLs don’t apply to a user who logs in locally. To keep files private from other local users, Windows XP provides a different mechanism.\u00a0 You can assign permissions to individual files and folders at file system level. This is called\u00a0File Permissions<\/b>, and it’s only available on NTFS volumes. You can’t set File Permissions on FAT volumes.<\/p>\n By default, Windows XP uses File Permissions only in the\u00a0Documents and Settings\u00a0<\/i>folder, to keep each user’s documents private from other users. When a user logs on locally for the first time, his ‘Home Directory’ is created within the\u00a0Documents and S<\/i>ettings folder. The default settings for all of the folders and files in each user’s\u00a0My Documents<\/i>\u00a0folder are:<\/p>\n Notice that\u00a0Administrator<\/i>s can look into the user’s\u00a0My Documents<\/i>\u00a0folder.\u00a0 Be aware that any user accounts that you created when you installed XP are\u00a0Administrator\u00a0<\/i>accounts, and that they can all look into each other’s\u00a0My Documents\u00a0<\/i>folders!\u00a0 Individual users may step up the security a notch to remove\u00a0Administrators<\/i>\u00a0from the list. Then, only that individual user can access his or her own files. When a user with an\u00a0Administrator\u00a0<\/i>account sets a password on the account, Windows XP automatically prompts the user to step up the security on\u00a0My Documents<\/i>.\u00a0 It’s then called\u00a0Private<\/i>.<\/p>\n In order access shared data, a user connecting from the network needs to get past both gatekeepers:<\/p>\n Having set up the share permissions, do we now need to do anything with NTFS permissions?<\/p>\n The short answer is ‘It Depends’.<\/p>\n If the shared folder is contained within\u00a0Documents and Settings<\/i>\u00a0(e.g. the\u00a0My Documents<\/i>\u00a0folder), then you might. This is because Windows XP sets NTFS permissions within this folder structure to prevent users from accessing each other’s data. It depends on whether the user accounts are\u00a0Limited\u00a0<\/i>or\u00a0Administrators<\/i>, and it also depends on whether the shared folder has been previously marked as\u00a0Private<\/i>.<\/p>\n If you created a folder structure elsewhere, then you most likely do not need to do anything more.\u00a0 The necessary permissions will be ‘inherited’, ultimately from the root folder, e.g. C:\\<\/p>\n In the example we’ve used so far, we don’t need to do any further configuration for everything to work.<\/p>\n Power User Information<\/span>:\u00a0<\/b>To see why, look at the NTFS permissions. Run Windows Explorer, and browse to\u00a0c:\\Boystuff<\/i>.\u00a0 Right-click the folder and select\u00a0Sharing and\u00a0<\/i>Security.\u00a0 Go to the\u00a0Security<\/i>\u00a0tab and look at the list. Note that the permissions are additive. Apart from yourself and\u00a0Administrators<\/i>, how can the users\u00a0Alasdair\u00a0<\/i>and\u00a0Fraser\u00a0<\/i>access the data in this share? It looks like they are not included on the NTFS permissions!<\/p>\n The answer is due to their membership in the\u00a0Users<\/i>\u00a0group.<\/p>\n Click the\u00a0Users<\/i>\u00a0group to see what permissions it has.<\/p>\n They seem to have Read-only access.\u00a0 Yet, if you try it, they have Write access, too!\u00a0 How can this be?<\/p>\n Scroll down, and see they have ‘Special’ permissions.\u00a0 This is gray, indicating they’ve inherited this permission from a parent folder.<\/p>\n What, pray tell, is Special Permission?\u00a0 Click\u00a0Advanced<\/i>\u00a0to see.\u00a0 In the\u00a0Permission entries<\/i>\u00a0window, double-click\u00a0Allow Users(RONS-PC\\Users) Special Inherited From C:\\<\/i>. You’ll see that it has inherited Write permission from the Root folder:<\/p>\n When a user on another computer on the network attempts to access a shared disk or folder, Windows XP Professional checks to see whether that user has permission to access it.\u00a0 The client computer sends the user name and password of the user who is currently logged in, and the XP Professional computer checks them.\u00a0 If those \u2018credentials’ match an account on XP Professional, then it checks the ACL for the shared disk or folder.\u00a0 If the ACL permits access by that user, access is granted; if not, access is denied.<\/p>\n On a client running Windows 95, 98, or Me, that’s the whole story.\u00a0 The user must be logged in with a user name and password that XP Professional recognizes.<\/p>\n On a client running Windows 2000 or XP, there’s more to the story.\u00a0 If XP Professional doesn’t recognize the logged-in user name and password, it causes the client computer to prompt the user to enter a different user name and password.<\/p>\n The following shows how to connect to a shared disk or folder from a computer running Windows 95, 98, or Me, and also shows some of the more common error conditions which can occur. In this example, the client computer is running Windows 98 Second Edition.<\/p>\n Under Windows 95\/98\/Me, you can set the\u00a0Primary Network Logon\u00a0<\/i>to\u00a0Windows Logon<\/i>, and all of the networking features described here will function correctly.\u00a0 The only situation in which the\u00a0Primary Network Logon<\/i>\u00a0must be set to\u00a0Client for Microsoft Networks<\/i>\u00a0is to log on to a Windows NT server or a Windows 2000 server.<\/p>\n The most important thing is to understand that everything is keyed to the user name. When you boot up the client machine, you need to get logged in with the correct user name.<\/p>\n Many Windows 95\/98\/Me machines are configured to boot all the way through to the Windows desktop without the user actually performing a login. If this is the case, click the\u00a0Start<\/i>\u00a0button, and look at the\u00a0Log Off\u00a0<\/i>menu option. It will show you what user name is currently logged on. If it isn’t correct, then click\u00a0Log Off<\/i>\u00a0and log back on under the correct user name. If the XP Professional account was set up with a password, then you must enter that password at the Windows logon prompt. If you configured XP to permit \u2018blank’ password authentication, then you may click\u00a0OK\u00a0<\/i>without entering a password.<\/p>\n Now, you ought to be able to browse the network by double-clicking Network Neighborhood<\/i>\u00a0(or\u00a0My Network Places<\/i>).<\/p>\n If you get an error at this stage, you’re most likely not logged on. See the Troubleshooting section for how to proceed.<\/p>\n <\/p>\n You can now browse the contents of the XP Professional machine by double-clicking it.<\/p>\n If the list of shares appears, then all is well. However, a common failure at this point is to be asked for the\u00a0IPC$<\/i>\u00a0password. This happens because the XP Professional machine is not satisfied with the credentials of the user attempting to browse it. See the\u00a0Troubleshooting section<\/b>\u00a0for how to proceed.<\/p>\n You may now look in the individual shares.\u00a0 If all is well, you’ll see the shares that the user has permissions for, yet you ought to get an Access Denied<\/i>\u00a0error (below) if you attempt to access other shares. In this example, we’re logged in as\u00a0Fraser<\/i>\u00a0and can access the Boys’ stuff, but not the Girls’ stuff (right).<\/p>\n If Windows XP Professional doesn’t recognize the user name and password presented by a Windows 2000 or XP computer which wants to access a share, you can enter different credentials.\u00a0 Here, we’re logged on to another Windows XP computer as a user which doesn’t have an account on the computer named RONS-PC.\u00a0 Entering a valid user name and password grants access.<\/p>\n In this example, we cover the situation where you need to consider NTFS permissions as well as share permissions.<\/p>\n The situation described here will only occur if either of the following conditions is true:<\/p>\n In either of these cases, you’ll run into NTFS permission problems. However, if you created the user accounts as\u00a0Administrator<\/i>\u00a0accounts, and the\u00a0My Documents<\/i>\u00a0folder has not been marked as\u00a0Private<\/i>, then no further action is necessary, since\u00a0Administrators<\/i>\u00a0have NTFS access to default (non-Private<\/i>)\u00a0My Documents<\/i>\u00a0folders.<\/p>\n We’re logged on to the XP machine as\u00a0Ron<\/i>\u00a0and wish to share the\u00a0My Documents\u00a0<\/i>folder across the network to the girls,\u00a0Iona<\/i>\u00a0and\u00a0Catriona<\/i>.<\/p>\n I use Windows Explorer, browse to\u00a0My Documents<\/i>, right-click, and look for\u00a0Sharing and Security.\u00a0<\/i>\u00a0It’s missing!\u00a0 Presumably, you’re only expected to share sub-folders of\u00a0My Documents<\/i>. The option is present on\u00a0My Music<\/i>,\u00a0My Pictures<\/i>\u00a0etc.<\/p>\n If you really want to share the whole\u00a0My Documents<\/i>\u00a0folder, you still can: right-click it and select\u00a0Properties<\/i>\u00a0to see the\u00a0Sharing<\/i>\u00a0and\u00a0Security<\/i>\u00a0tabs.<\/p>\n We give it a share name (names containing blanks can cause problems, so we’ve made it\u00a0My-Documents<\/i>).\u00a0 In the\u00a0Permissions<\/i>\u00a0button, we add\u00a0Iona<\/i>\u00a0and\u00a0Catriona<\/i>\u00a0with\u00a0Read<\/i>\u00a0and\u00a0Change<\/i>\u00a0permission, and remove\u00a0everyone<\/i>, as before.<\/p>\n Now to test it!<\/p>\n But when we try to access\u00a0My-Documents<\/i>, we get an error message!<\/p>\n <\/p>\n What happened?\u00a0 We gave\u00a0Iona<\/i>\u00a0permissions to access the share, so why was she was not allowed?<\/p>\n Remember about network user having to get past both gatekeepers? Well,\u00a0Iona<\/i>\u00a0got past the share permissions level, only to be blocked at the NTFS permissions level.<\/p>\n Remember also that XP Professional sets up NTFS permissions on the\u00a0My Documents<\/i>\u00a0folder and that we created the users as\u00a0Limited\u00a0<\/i>accounts, not\u00a0Administrator<\/i>\u00a0accounts.<\/p>\n Let’s go back and fix it.\u00a0 We use Windows Explorer, browse to\u00a0My Documents<\/i>, right-click it, and select\u00a0Properties<\/i>. This time, we choose the\u00a0Security<\/i>\u00a0tab.\u00a0 Notice how ONLY\u00a0Administrators<\/i>\u00a0and the\u00a0Owner\u00a0<\/i>have any permissions!<\/p>\n To fix this issue, we need to either:<\/p>\nUser Accounts: Password or No Password?<\/b><\/h2>\n
\n
\n
\n
Create User Groups<\/b><\/h2>\n
\n
Create Shares<\/b><\/h2>\n
\n
Set Up Access Control Lists on the Shares<\/b><\/h2>\n
\n
NTFS Permissions<\/b><\/h2>\n
\n
\n
Connecting to a Share from a Client Computer<\/b><\/h2>\n
Connecting to a Share from Windows 95, 98, or Me<\/b><\/h4>\n
Connecting to a Share from Windows 2000 or XP<\/b><\/h4>\n
Sharing folders in\u00a0My Documents<\/i><\/b><\/h2>\n
\n
\n