1

We have machines in a department that auto-login with a department login at each machine so they all have the same generic properties. Managers and users both use these machines.

The department has a shared folder on the server. Is there a way to make that folder require the username and password before accessing it? We need the managers to be able to access it, but not the users. If I take away the auto-login account rights, no one can access it.

All managers already have an account due to having email and other programs that require a login. Machines in question are xp pro SP3 virtual machines running through thin clients.

Sorry if confusing...I don't know how else to state it, but can clarify if need be. And yes, I did search the subject.

I basically just need to know if the statement in the title can be done within windows without having to resort to some third party software.

5
  • 1
    So you want to reinforce one bad practice with another? Just set them up correctly, sell it on security (apparently PCI compliance is not a requirement there) and future ease of use Jul 24, 2013 at 14:21
  • You are going to get such suggestions whether you asked for them or not. It's like losing the key, then asking for the best explosive to open the door – most people will suggest a locksmith instead. If you completely cannot change the practices, then state it clearly in the question. Jul 24, 2013 at 14:47
  • Well, I was frustrated by the time I made it here after trying to figure this out myself. As we all know, someone does something stupid and IT gets to figure out how to fix it. All I wanted to know is what was in the Title. If there were any other options I would have listed them. If I could change the practices, I would have done so. The completely unnecessary comments about bad practices and general assumptions (we are PCI compliant BTW) on the part of someone from Wichita, KS which is 15 miles from me tends to further intensify the frustration. The comment was neither helpful nor
    – Josh
    Jul 24, 2013 at 15:35
  • inquisitive. That is all I was trying to point out. Be helpful, its a "help" site after all.
    – Josh
    Jul 24, 2013 at 15:38
  • And that's precisely what people offering better practices are doing. Jul 25, 2013 at 15:14

3 Answers 3

1

Ok, just using shorcuts.

First remove access to the shared folder from the department login.

Create one shortcut named "connect to shared folder" (or anything more explicit) and use this as a target :

\explorer.exe /e,\\[server]\[shared folder]

As the login used on the machine is not valid, the user will be presented with a small login window where he can enter another login (the manager's login). this login window will only have the name of the server so unfortunately it's not very explicit. After the log-in they will be presented with the shared folder in explorer.

The second shorcut will be name "Disconnect" and contain this target :

net use use \\[server]\[shared folder] /delete

Managers must remember to disconnect.

1
  • Thank you. Glad to be done with this question. Much obliged Nicolas.
    – Josh
    Jul 24, 2013 at 15:20
1
  • On the server remove permissions for the generic user accounts to the certain location.
  • Create a new user in AD and call it Managers and give it a password which only the managers will know.
  • Allow ONLY the user Managers access to the share
  • Create a new text file
  • Copy & paste this code (modify the domain appropriately)
  • runas /user:DOMAIN\Managers "explorer /separate"
  • Save the file as Managers.bat on the desktop (or somewhere they can easily access)
  • Now run the batch file

  • As you see it will prompt for the password for the user account Managers (as you type you won't be able to see anything)

  • Enter the password and it will bring up a windows explorer window with the Managers permissions.
  • They will now be able to access the Managers folder within that window. All they have to do is close it when they're finished.

  • As you removed the permissions for the generic accounts earlier no body else who doesn't know the password will be able to view these files.

1
  • That is a perfect solution minus one issue. I'm sorry, I forgot to mention that creating generic users is not an option. Corporate policies are rather strict here due to security and so a generalized login is forbidden. Even for this purpose. Can this be used in some varianceso that it prompts for both the actual AD username and password?
    – Josh
    Jul 24, 2013 at 14:27
0

Sounds like you work in a warehouse. I would set NTFS permissions on the shared folder to only allow the accounts the managers have to have read permissions on it, then to access the folder from the command line using net use like this:

net use \ServerName\sharename * /user:domainName\UserName

You can find more info on net use here http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/net_use.mspx?mfr=true

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .