Chapter 7: Configuring File and Share Access

Chapter 7: Configuring File and Share Access

• The chapter covers configuring file and share access, designing file sharing strategies, creating folder shares, assigning permissions, and configuring NTFS quotas.

Overview of Chapter Objectives

• Chapter objectives include configuring file and share access, designing file sharing strategies, creating folder shares, assigning permissions, and configuring NTFS quotas.

Creating Folder Shares

• Shares must be created for network users to access server disks.

• Crucial factors to determine when creating shares include:

  • Folders to share
  • Share names
  • User permissions for shares
  • Offline Files settings for shares

• Folder shares can be created by right-clicking a folder and selecting "Share with Specific People."

• A simplified interface is provided by this method.

• Users can also configure folders for sharing through the folder's properties sheet, offering more control options.

Types of Folder Shares

• Server Message Blocks (SMB):
  • A standard file-sharing protocol used across all Windows versions.
  • Requires the File Server role service.
• Network File System (NFS):
  • A standard file-sharing protocol predominantly employed in UNIX and Linux systems.
  • Requires the server to have NFS role service installed.

Creating a Folder Share Steps

• Select the profile: Choose from basic SMB profiles (Quick, Advanced, Applications) or NFS profiles. Profiles dictate settings for sharing style.
• Select the server and path: Determine the server and folder path for the share. Options include volume selection or custom path; the location will be a new folder in the \Shares directory on the selected volume.
• Specify share name: Assign a name and description for the folder share.
• Configure share settings:
  • Decide on access enumeration for files on the share.
  • Determine whether to enable caching or BranchCache for offline file access making content available to offline users.
  • Decide on encryption for data access during share operations to secure data transmitted to and from the share.
• Specify permissions: Define folder permissions for security principals using Basic or Advanced Permissions.
• Confirm selections: Review the configured settings for the file share. A confirmation page verifies the local path, server, cluster role, protocol, and other settings.

Assigning Permissions

• Windows Permissions Architecture:

  • Access Control List (ACL): A list of permissions related to a folder.
  • Access Control Entries (ACEs): Define permissions for specific security principals, like users or groups.

• Windows permits granular control of permissions through the security settings page.

• The "Additive" approach to assigning permissions begins with a blank set and uses multiple "Allow" entries to grant various access levels.

• The "Subtractive" approach starts by assigning all access ("Allowed"), then selectively removing ("Deny").

• Permissions:

  • "Full Control": Grants all possible rights (change permissions, take ownership, perform any action enabled by the "Change" permission).
  • "Change": Allows modification of file permissions and ownership.
  • "Read": Viewing folder names, filenames, file data, attributes, and accessing other folders within the shared folder.
  • "Write": Overwriting files, modifying attributes, viewing ownership and permissions.
  • "Read & Execute": Navigating restricted folders and performing actions allowed by Read permissions (including reading and running application files).
  • "List Folder Contents": Viewing folder names and subfolder names.
  • Additional permissions include special permissions, like "Read Extended Attributes", "Create Files/Write Data," "Create Folders/Append Data," etc.

NTFS Authorization

• NTFS and ReFS support permissions for each file and folder, including an ACL with ACEs.
• Each ACE specifies permissions for security principals (users and groups) using security identifiers (SIDs).
• Authorization involves comparing user SIDs with elements’ ACEs to determine access levels.

NTFS Basic Permissions (Folder and File), Overview

• Permissions listed include:
  • Full Control
  • Modify
  • Read & Execute
  • List Folder Contents
  • Read
  • Write

Combining Share and NTFS Permissions

• Share permissions (FC) and NTFS permissions combined offer network folder access.
• Local permissions are often NTFS permissions, while the more restrictive permission set will prevail during conflicting remote share or NTFS access.

Volume Shadow Copies

• Allows maintainance of file versions, recovering accidentally deleted or overwritten data.
• Functionally available for entire volumes only, not specific shares or folders.

Configuring NTFS Quotas

• Enables administrative control of storage limits per volume.
• NTFS quotas limit the storage space available to specific users on a shared volume, preventing disk usage overload.
• To configure, use the “Quota” tab in the Volume’s Properties page.