0

It appears that Windows 7 takes a different approach than Vista to sharing user's profile folders: In Vista, when I shared the Public profile using the Network and Sharing Center, it created a share called "Public" (if I remember correctly). In Windows 7, the "User" folder is shared instead, and the rest is taken care of by NTFS permissions.

I like this approach. Still, I noticed one side-effect when activating password-free public folder sharing[1]: Since Users\Default is readable by everyone, it is also accessible remotely (as a hidden folder). Now, I don't think this is a security risk, since it's read-only access, but it still appears strange to me. Is this really by design?


Disclaimer against people who just skim over the question and start answering immediately: Don't tell me how to manually share folders, how to set share and/or NTFS permissions, how to use the homegroup feature, or that it's dangerous to turn off Password Protected Sharing. I know all of that. This is not the question! :-)

[1]: Network and Sharing Center/Choose Homegroup and Sharing Options/Change advanced sharing settings. Turn on Public folder sharing and turn off Password protected sharing.

1
  • This a huge security risk!. We had dozens of users in our company sharing their documents and files without even knowing.
    – user191007
    Jan 18, 2013 at 15:16

2 Answers 2

3

Since I can't comment on PilotBobs answer:

This is by design and doesn't pose a security risk, as I understand the feature.

There is a technet article which describes how this thing works:

When any folder or file within a user’s profile is shared, the Windows sharing engine creates a single share to facilitate sharing out that content. This helps facilitates several sharing scenarios. It facilitates scenarios which allow the sharing of individual files while also reducing the management overhead for creating and maintaining multiple shares on the computer. It also allows standard users on that same computer to share their own content without the need to create additional shares, which requires UAC elevation.

Additionally, both Windows Vista and Windows 7 use a Server Message Block (SMB) feature called Access-based Enumeration to limit what content is shown to others when they access this share. With the Access-based Enumeration feature enabled, users accessing the share are only shown the content they have access to over SMB and everything else is hidden from them.

I find this feature actually very nice because you can share single files and, in addition, you keep the folder structure.

0

Personally I see this as a huge security risk and a bug. I had no idea that my User folder was shared.

Keep in mind that the Users folder contains your Desktop, My Document, My Music, Pictures, etc.

I was extremely surprised to find that my users folder was shared. Granted it looked like the Share only allowed read (didn't double check) but Everyone is added to NTFS permission with Modify rights.

BTW: I do not have a home group. I manually shared a folder in my user (home) folder to allow other users to grab files I put there. One user I directed to my machine said he could access my User folder. Further google searches on this seem to say that sharing sub-folders of the home folder forces this to happen. I would have to test that.

I find this issue when searching and there are many people that agree with me.

Once again, huge security risk and in my opinion a FATAL BUG that MS needs to fix ASAP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .