1

I have to share a set of .docx files from my computer. They are set so that administrators have full control over the shares, and "everyone" has access to read and execute them. I need to find a way to share them with everyone but a blacklist.

To make things more difficult, it has to be IP address, not usernames.

I don't know what other useful information you may need, but if it helps this is on a Windows 7 machine. Hopefully someone out there can help me.

3
  • 1
    Have you tried blocking the IP with Windows Firewall? Aug 7, 2013 at 14:33
  • I disable Windows firewall because it causes connectivity issues with different areas. It's a large building with several switches etc. It seems to work best when I have the firewall disabled, but could it just be my own superstition?
    – Kryptos
    Aug 7, 2013 at 14:37
  • 1
    It will block connections coming into your computer unless you open up specific ports, but it's not a haphazard thing... either it blocks them or it doesn't. You can review the logs to see if the Firewall is actually blocking things when it shouldn't be, and create additional rules when appropriate. Aug 7, 2013 at 14:44

2 Answers 2

1

Im not sure if I completely understand the requirements of your question, however look at the following:

Both Windows Sharing and Windows File Security have option to Allow and Deny access to a files and/or folders based on user names and/or computer names and/or Active Directory security groups.

So you can set the share/file security to allow Everyone, yet deny a list of computers. This would be best accomplished in creating an AD security group with all the computers you want to deny. Creating an AD security group is easier, as you want to reuse this group elsewhere.

Important note: Deny always takes precedence over Allow

7
  • I think this could work.. do I have to install Active Directory? I can't seem to find it on my PC by default. If so, where?
    – Kryptos
    Aug 7, 2013 at 15:07
  • Oh you arent in an AD environment? Do you have a Windows administrator in your environment? If so, talk to him. Otherwise its still ok, you can still do the same thing, it will just be more time consuming as you will need to manually add all the machines to deny.
    – Keltari
    Aug 7, 2013 at 15:55
  • I don't have permission from the IT gods to use AD. It's basically my PC to everyone else with out any help, influence, etc from IT.
    – Kryptos
    Aug 7, 2013 at 15:58
  • So there is an AD environment? This is something they can set up easily and quickly. This is what they do. Ask them to set it up.
    – Keltari
    Aug 7, 2013 at 15:59
  • There is but I 100% for sure will not be given access.. I think I can create a group on my local machine though. I tried that and was able to add a test computer to it. (mmc.exe) I supposedly blocked the group, but the computer still has access
    – Kryptos
    Aug 7, 2013 at 16:01
1

Windows Security Model restricts access per-user, not per-IP. Basically, you can configure firewall options for File and Printer Sharing service to only permit certain IP communications, but this will restrict all the shares on this computer for that IP only. I wouldn't recommend blocking via IP since it could be spoof'd anyways. Here's a nifty link on Windows File Sharing;

http://windows.microsoft.com/en-us/windows-vista/share-files-and-folders-over-the-network-from-windows-vista-inside-out

"NTFS permissions apply to folders and files on an NTFS-formatted drive. They provide extremely granular control over an object."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .