I have to share a set of .docx files from my computer. They are set so that administrators have full control over the shares, and "everyone" has access to read and execute them. I need to find a way to share them with everyone but a blacklist.

To make things more difficult, it has to be IP address, not usernames.

I don't know what other useful information you may need, but if it helps this is on a Windows 7 machine. Hopefully someone out there can help me.

  • 1
    Have you tried blocking the IP with Windows Firewall? – Darth Android Aug 7 '13 at 14:33
  • I disable Windows firewall because it causes connectivity issues with different areas. It's a large building with several switches etc. It seems to work best when I have the firewall disabled, but could it just be my own superstition? – Kryptos Aug 7 '13 at 14:37
  • 1
    It will block connections coming into your computer unless you open up specific ports, but it's not a haphazard thing... either it blocks them or it doesn't. You can review the logs to see if the Firewall is actually blocking things when it shouldn't be, and create additional rules when appropriate. – Darth Android Aug 7 '13 at 14:44

Im not sure if I completely understand the requirements of your question, however look at the following:

Both Windows Sharing and Windows File Security have option to Allow and Deny access to a files and/or folders based on user names and/or computer names and/or Active Directory security groups.

So you can set the share/file security to allow Everyone, yet deny a list of computers. This would be best accomplished in creating an AD security group with all the computers you want to deny. Creating an AD security group is easier, as you want to reuse this group elsewhere.

Important note: Deny always takes precedence over Allow

  • I think this could work.. do I have to install Active Directory? I can't seem to find it on my PC by default. If so, where? – Kryptos Aug 7 '13 at 15:07
  • Oh you arent in an AD environment? Do you have a Windows administrator in your environment? If so, talk to him. Otherwise its still ok, you can still do the same thing, it will just be more time consuming as you will need to manually add all the machines to deny. – Keltari Aug 7 '13 at 15:55
  • I don't have permission from the IT gods to use AD. It's basically my PC to everyone else with out any help, influence, etc from IT. – Kryptos Aug 7 '13 at 15:58
  • So there is an AD environment? This is something they can set up easily and quickly. This is what they do. Ask them to set it up. – Keltari Aug 7 '13 at 15:59
  • There is but I 100% for sure will not be given access.. I think I can create a group on my local machine though. I tried that and was able to add a test computer to it. (mmc.exe) I supposedly blocked the group, but the computer still has access – Kryptos Aug 7 '13 at 16:01

Windows Security Model restricts access per-user, not per-IP. Basically, you can configure firewall options for File and Printer Sharing service to only permit certain IP communications, but this will restrict all the shares on this computer for that IP only. I wouldn't recommend blocking via IP since it could be spoof'd anyways. Here's a nifty link on Windows File Sharing;


"NTFS permissions apply to folders and files on an NTFS-formatted drive. They provide extremely granular control over an object."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.