I have encountered a strange issue and I would like to get some advice/insight from the community.
Windows 7 Pro Machine acting as a "Server" with a shared company folder that we will call
Windows 7 and 10 clients each have their own credentials to connect to this "server".
Share folder contains sub-folders that are shared based on user credentials.
Folder access works properly when browsing the folder, users have access where access is granted, no access where access has not been granted.
The specifics of the problem:
For simplicity, say there is a top-level folder named
Share and two sub-folders, one called
Admin and one called
Inventory. Admin is only shared with managers, but Inventory is shared with all.
I create an Excel file named
AdminFile.xlsx in the Admin folder and assign the value
Success! to cell
I then create an Excel file named
AdminFileViewer.xlsx in the Inventory folder and assign the array formula
AdminFileViewer.xlsx can read the AdminFile.xlsx and displays the result "Success!" for users that do not have access to the
\\Server\Share\Admin\AdminFile.xlsx file location.
I have confirmed that on the user's PC the folder
\\Server\Share\Admin cannot be navigated to.
I did some testing on my local machine, placing a file in the admin user folder and attempting the same, which causes Excel to prompt for the file location since it does not have access to the admin folder from my user space. This causes a UAC prompt on the local machine. This is slightly different that the restricted access prompt that appears on the network folder when trying to access a restricted folder by entering the complete path in Win Explorer. The error there is "You do not have permission to access this folder - please contact your network administrator"
My concern is that, for example, someone knows that a file named
EmployeeSalaries.xlsx exists in the
Admin folder and can then read the contents of that file with the above method without having the actual credentials to access it outright.
I am interested in anyone's thoughts on the matter. Please let me know if there is any information I can provide to clarify.