0

I'm testing UNC Paths + Combinaiton of different ACEs. I have a few files which cannot be read by a user named Bob because He's been denied Read permissions on these files.He's however granted the permission to List the contents of the folder to which these files belong. I can see these files as Bob when I access them locally , albeit they're still not accessible but at least visible . The same folder when accessed via a UNC Path does not list these files for which Bob does not have read permissions. I noticed this on Windows Server 2008. Can anyone please explain why UNC hides these files but local paths show them ?

  • just a best practice, do not use share based permissions, and instead handle your security with the filesystem permissions underlying the share. MS recommends doing so, because troubleshooting is easier, and because if you lose the OS you lose the share permissions, but the filesystem permissions remain in place on secondary volumes, even when backed up to other media. so just leave the share as Everyone-Full Control and use the filesystem permissions to lock it down. – Frank Thomas Sep 9 '14 at 13:02
1

I would guess what you are talking about is a feature from Windows Server 2003 SP1 upwards called ABE. It's an advanced sharing feature designed to hide files and folders from view of users who do not have access to at least read them.

You can review the ABE settings on your Server by going to Share and Storage Management, open properties on the share then go to SMB settings and advanced. I believe there is a ticket box to enable/disable the Access Based Enumeration...

I'm going from memory as not in front of a Server at the moment so hopefully the above steps are correct.

Thanks,

Charles

  • Thanks Charles , disabling ABE did the trick.I still wonder why show these files to the user if he accesses them through a local path. I guess hiding them when the "hidden" flag is not set is illogical. :) – Dhiwakar Ravikumar Sep 10 '14 at 4:10
  • Well I think Microsoft assume that the user would not be able to access that path any other way rather than a UNC. Would you be kind enough to mark this as an answer on the left hand side? :) thanks – CharlesH Sep 10 '14 at 8:12

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.