0

I have encountered a strange issue and I would like to get some advice/insight from the community.

Some facts:

Windows 7 Pro Machine acting as a "Server" with a shared company folder that we will call Share Windows 7 and 10 clients each have their own credentials to connect to this "server". The Share folder contains sub-folders that are shared based on user credentials. Folder access works properly when browsing the folder, users have access where access is granted, no access where access has not been granted.

The specifics of the problem:

For simplicity, say there is a top-level folder named Share and two sub-folders, one called Admin and one called Inventory. Admin is only shared with managers, but Inventory is shared with all.

I create an Excel file named AdminFile.xlsx in the Admin folder and assign the value Success! to cell A1.

I then create an Excel file named AdminFileViewer.xlsx in the Inventory folder and assign the array formula {='\\Server\Share\Admin\[AdminFile.xlsx]!$A$1}

AdminFileViewer.xlsx can read the AdminFile.xlsx and displays the result "Success!" for users that do not have access to the \\Server\Share\Admin\AdminFile.xlsx file location.

I have confirmed that on the user's PC the folder \\Server\Share\Admin cannot be navigated to.

I did some testing on my local machine, placing a file in the admin user folder and attempting the same, which causes Excel to prompt for the file location since it does not have access to the admin folder from my user space. This causes a UAC prompt on the local machine. This is slightly different that the restricted access prompt that appears on the network folder when trying to access a restricted folder by entering the complete path in Win Explorer. The error there is "You do not have permission to access this folder - please contact your network administrator"

My concern is that, for example, someone knows that a file named EmployeeSalaries.xlsx exists in the Admin folder and can then read the contents of that file with the above method without having the actual credentials to access it outright.

I am interested in anyone's thoughts on the matter. Please let me know if there is any information I can provide to clarify.

0

Based on my tests, if users create a new formula to refer to the workbook they can't access on the shared folder because they don't have the right to read,change and full control. They won't get the value of cell from the workbook. It will show a #REF! error.

If you create a formula to refer to the cell in the workbook AdminFile.xlsx in Admin folder, the reference will be successful. The value will be input into the AdminFileViewer.xlsx. If the Automatic recalculating isn't enabled, the users will see the value of cells refer to AdminFile.xlsx.

enter image description here

1
  • My problem is that users that do not have access to the admin folder can see file contents by using the method explained in my post. I am wondering if this has something to do with folder share vs NTFS permissions, or something else. Looking forward to yours, or anyone else's ideas of things I could test and/or check to get to the bottom of this. – D.ozer Aug 28 '19 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.