Shared Folders

You can use the Shared Folders snap-in to manage shared resources over a network. With Shared Folders you can control user access permissions, session activity, and shared resource properties.

  • For tips about using Shared Folders, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

Assign permissions to groups, not user accounts.

  • Assigning permissions to groups simplifies management of shared resources, because you can then add users to or remove them from the groups without having to reassign permissions. To deny all access to a shared resource, deny the Full Control permission.

Assign the most restrictive permissions that still allow users to perform required tasks.

  • For example, if users need only to read information in a folder, and they will never delete, create, or change files, assign the Read permission.

If users log on locally to access shared resources, such as on a terminal server, set permissions by using NTFS file system permissions or access control.

  • Share permissions apply only to users who access shared resources over the network; they do not apply to users who log on locally. For this situation, use NTFS and access control. For more information, see To set, view, change, or remove permissions on files and folders.

Organize resources so that objects with the same security requirements are located in the same folder.

  • For example, if users require the Read permission for several application folders, store the application folders in the same parent folder. Then, share the parent folder, rather than sharing each individual application folder. Note that if you need to change the location of an application, you may need to reinstall it.

When you share applications, organize all shared applications in one folder.

  • Organizing all applications in one shared folder simplifies administration, because there is only one location for installing and upgrading software.

To prevent problems with accessing network resources, do not deny permissions to the Everyone group.

  • The Everyone group includes anyone who has access to network resources, including the Guest account, with the exception of the Anonymous Logon group. For more information, see Default security settings for groups and Differences in default security settings.

Avoid explicitly denying permissions to a shared resource.

  • It is usually necessary to explicitly deny permissions only when you want to override specific permissions that are already assigned.

Limit membership in, and assign the Full Control permission to, the Administrators group.

  • This enables administrators to manage application software and to control user rights.

In most cases, do not change the default permission (Read) for the Everyone group.

  • The Everyone group includes anyone who has access to network resources, including the Guest account. In most cases, do not change this default unless you want users to be able to make changes to the files and objects in the shared resource. For more information about share permissions, see Share permissions.

Grant access to users by using domain user accounts.

  • On computers running XOX that are connected to a domain, grant access to shared resources through domain user accounts, rather than through local user accounts. This centralizes the administration of share permissions.

Use centralized data folders.

  • With centralized data folders, you can manage resources and back up data easily.

Use intuitive, short labels for shared resources.

  • This ensures that the shared resources can be easily recognized and accessed by users and all client operating systems.

Use a firewall.

  • A firewall protects shared resources from access through the Internet. In XOX and in the Windows Server 2003 family, you can take advantage of new firewall capabilities. For more information, see Internet Connection Firewall.


How to...

  • Share a folder or drive
  • Set permissions on a shared resource
  • View information about shared resources
  • Manage properties of a shared resource
  • Disconnect a user or users
  • Close an open file or resource
  • Stop sharing a resource
  • Limit the number of users of a shared resource
  • Configure offline settings for a shared resource


Share a folder or drive

Microsoft Windows graphic

To share a folder or drive

Using Shared Folders

  1. XOX
  2. In the console tree, click Shares.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Shares
  3. On the Action menu, click New Share.
  4. Follow the steps in the Share a Folder Wizard, and then click Finish.

Note

  • XOX

Using Windows Explorer

  1. Open Windows Explorer.
  2. Right-click the folder or drive to be shared, and then click Sharing and Security.
  3. Click Share this folder.
  4. Set any other options that you want, and then click OK.

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    net share sharename=drive:path

Value | Description
net share | Creates, deletes, or displays shared resources.
sharename=drive:path | The network name of the shared resource and the absolute path of its location.

Notes

  • XOX
  • To view the complete syntax for this command, at the command prompt, type:

    net help share

Important

  • When you create a shared resource, determine how to secure that resource. There are several methods that you can use to secure shared resources. For more information, see Related Topics.

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • You can use Shared Folders to manage shared resources on both local and remote computers. For information about how to connect to another computer, see Related Topics. With Windows Explorer and the command line, you can manage shared resources on your local computer only.
  • You can hide the shared resource from users by typing $ as the last character of the shared resource name (the $ then becomes part of the resource name). Users can map a drive to this shared resource, but they cannot see the shared resource when they browse to it in Windows Explorer, or in My Computer on the remote computer, or when they use the net view command on the remote computer. For more information about this command, see Related Topics.
  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. (http://www.microsoft.com/)

Related Topics


Set permissions on a shared resource

Microsoft Windows graphic

To set permissions on a shared resource

Using Shared Folders

  1. XOX
  2. In the console tree, click Shares.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Shares
  3. In the details pane, right-click the shared resource that you want to set permissions for, and then click Properties.
  4. On the Share Permissions tab, make any of the following changes, and then click OK:
    • To assign permissions to a user or group for a shared resource, click Add. In the Select Users, Computers, or Groups dialog box, look for or type the user or group name, and then click OK.
    • To revoke access to the shared resource, click Remove.
    • To set individual permissions for the user or group, in the Permissions for group or user box, select the Allow or Deny check boxes.

Note

  • XOX

Using Windows Explorer

  1. Open Windows Explorer.
  2. Right-click the shared folder or drive that you want to set permissions for, and then click Sharing and Security.
  3. On the Sharing tab, click Permissions, make any of the following changes, and then click OK:
    • To assign permissions to a user or group for a shared resource, click Add. In the Select Users, Computers, or Groups dialog box, look for or type the user or group name, and then click OK.
    • To revoke access to a shared resource, click Remove.
    • To set individual permissions for the user or group, in the Permissions for group or user box, select the Allow or Deny check boxes.

Note

  • XOX

Important

  • Share permissions apply only to users who gain access to the resource over the network. They do not apply to users who log on locally, such as on a terminal server. In these cases, use access control on the NTFS file system to set permissions. For more information, see Related Topics.

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • You can use Shared Folders to manage shared resources on both local and remote computers. For information about how to connect to another computer, see Related Topics. With Windows Explorer and the command line, you can manage shared resources on your local computer only.
  • When permissions have been assigned both to the shared resource and at the file system level, the more restrictive permission always applies.
  • It is usually easier to assign permissions to groups and then add users to groups, rather than assigning identical permissions to individual users.
  • If you change permissions on special shared resources, such as ADMIN$, the default settings may be restored when the Server service is stopped and restarted or when the computer is restarted. Note that this does not apply to user-created shared resources whose share name ends in $. For more information about special shared resources, see Related Topics.
  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. (http://www.microsoft.com/)

Related Topics


View information about shared resources

Microsoft Windows graphic

To view information about shared resources

Using Shared Folders

  1. XOX
  2. In the console tree, click one of the following folders:
    • To view information about the shared resources on the selected computer, click Shares.
    • To view information about open sessions, click Sessions.
    • To view information about open files, click Open Files.

    Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Shares, Sessions, Open Files

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type one of the following:

    net share

    net session

    net file

Value | Description
net share | Displays information about all shared resources on the local computer.
net session | Displays information about all open sessions between the local computer and other computers on the network.
net file | Displays information about all open files on shared resources.

Notes

  • XOX
  • To view the complete syntax for these commands, at the command prompt, type one of the following:

    net help share

    net help session

    net help file

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • When you administer another computer remotely, your connection appears as an open named pipe. It cannot be closed.
  • Only files that are open on the selected computer are visible.
  • For information about how to connect to another computer, see Related Topics.
  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. (http://www.microsoft.com/)

Related Topics


Manage properties of a shared resource

Microsoft Windows graphic

To manage properties of a shared resource

Using Shared Folders

  1. XOX
  2. In the console tree, click Shares.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Shares
  3. In the details pane, right-click the shared resource that you want to manage, and then click Properties.
  4. Make the changes that you want, and then click OK.

Note

  • XOX

Using Windows Explorer

  1. Open Windows Explorer.
  2. Right-click the shared folder or drive that you want to manage, and then click Sharing and Security.
  3. Make the changes that you want, and then click OK.

Note

  • XOX

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • You can use Shared Folders to manage shared resources on both local and remote computers. For information about how to connect to another computer, see Related Topics. With Windows Explorer and the command line, you can manage shared resources on your local computer only.
  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. http://www.microsoft.com/)

Related Topics


Disconnect a user or users

Microsoft Windows graphic

To disconnect a user or users

Using Shared Folders

  1. XOX
  2. In the console tree, click Sessions.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Sessions
  3. Do one of the following:
    • To disconnect all users, on the Action menu, click Disconnect All Sessions.
    • To disconnect one user, in the details pane, right-click the user name, and then click Close Session.
    • To disconnect multiple users, press the CTRL key while clicking the user names, right-click any user name, and then click Close Session.

Notes

  • XOX
  • When you administer another computer remotely, your connection appears as an open named pipe. It cannot be closed.

Using a command line

  1. Open Command Prompt.
  2. Type:

    net session \\computername /delete

Value | Description
net session | Lists or disconnects inbound sessions on the local computer.
\\computername | Identifies the computer for which you want to list or disconnect sessions.
/delete | Ends sessions that are originated by \\computername, and closes all open files that are opened from \\computername. If \\computername is omitted, all inbound sessions and associated files are closed.

Notes

  • XOX
  • To view the complete syntax for this command, at the command prompt, type:

    net help session

Caution

  • If you disconnect users who are accessing shared resources, they might lose data. You may want to warn connected users before you disconnect them.

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • For information about how to connect to another computer, see Related Topics.
  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. (http://www.microsoft.com/)

Related Topics


Close an open file or resource

Microsoft Windows graphic

To close an open file or resource

Using Shared Folders

  1. XOX
  2. In the console tree, click Open Files.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Open Files
  3. Do one of the following:
    • To disconnect all open resources, on the Action menu, click Disconnect All Open Files.
    • To disconnect one open file or resource, in the details pane, right-click the file name, and then click Close Open File.
    • To disconnect multiple open files or resources, press the CTRL key while clicking the file names, right-click any selected file name, and then click Close Open File.

Note

  • XOX

Using a command line

  • Open Command Prompt.
  • Type:

    net file ID /close

Value | Description
net file | Displays the names of all open shared files on a server and the number of file locks, if any, on each file.
ID | The dynamically assigned ID of the shared resource.
/close | Closes the shared resource and removes file locks. Type this command from the server where the file is shared.

Notes

  • XOX
  • You can use the openfiles command to determine the file ID of the shared resource. For more information, see Related Topics.
  • To view the complete syntax for this command, at the command prompt, type:

    net help file

Caution

  • If you close open files or resources, users might lose data. You may want to warn connected users before you close an open file or resource. For more information, see Related Topics.

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • You can use Shared Folders to manage shared resources on both local and remote computers. For information about how to connect to another computer, see Related Topics. With Windows Explorer and the command line, you can manage shared resources on your local computer only.
  • When you administer another computer remotely, your connection appears as an open named pipe. It cannot be closed.
  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. (http://www.microsoft.com/)

Related Topics


Stop sharing a resource

Microsoft Windows graphic

To stop sharing a resource

Using Shared Folders

  1. XOX
  2. In the console tree, click Shares.

    Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Shares
  3. In the details pane, right-click the folder that you want to stop sharing, and then click Stop Sharing.

    To stop sharing multiple instances of a folder or drive, press the CTRL key while you click the instances, right-click any instance of the folder or drive, and then click Stop Sharing.

Note

  • XOX

Using Windows Explorer

  1. Open Windows Explorer.
  2. Right-click the shared folder or drive that you want to stop sharing, and then click Sharing and Security.
  3. On the Sharing tab, do one of the following, and then click OK:
    • To stop sharing all instances of the shared resource, click Do not share this folder.
    • To stop sharing only one instance of a folder or drive that is shared multiple times, in Share name, click the folder or drive that you want to remove, and then click Remove Share.

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    net share sharename /delete

Value | Description
net share | Creates, deletes, or displays shared resources.
sharename | The network name of the shared resource.
/delete | Stops sharing the resource.

Notes

  • XOX
  • To view the complete syntax for this command, at the command prompt, type:

    net help share

Caution

  • If you stop sharing open resources, users might lose data. You may want to warn connected users before you close an open file or resource. For more information, see Related Topics.
  • In most cases, it is recommended that you not stop sharing the special shared resources that are created by the system, such as ADMIN$. These special shared resources are automatically recreated with their original settings when the computer is restarted.
  • The special shared resources NETLOGON and SYSVOL are required on domain controllers. Removing them causes a loss of functionality on all clients that the domain controller serves.
  • The IPC$ special shared resource is required for the Server service to operate, and it cannot be deleted.

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • You can use Shared Folders to manage shared resources on both local and remote computers. For information about how to connect to another computer, see Related Topics. With Windows Explorer and the command line, you can manage shared resources on your local computer only.
  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base.(http://www.microsoft.com/)

Related Topics


Limit the number of users of a shared resource

Microsoft Windows graphic

To limit the number of users of a shared resource

Using Shared Folders

  1. XOX
  2. In the console tree, click Shares.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Shares
  3. In the details pane, right-click the shared folder or drive that you want to limit the number of users for, and then click Properties.
  4. Under User limit, click Maximum allowed, and then click OK, or click Allow this number of users.

    If you click Allow this number of users, type or click a maximum number of users, and then click OK.

Note

  • XOX

Using Windows Explorer

  1. Open Windows Explorer.
  2. Right-click the shared folder or drive that you want to limit the number of users for, and then click Sharing and Security.
  3. Under User limit, click Maximum allowed, and then click OK, or click Allow this number of users.

    If you click Allow this number of users, type or click a maximum number of users, and then click OK.

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    net share sharename /users:number

Value | Description
net share | Creates, deletes, or displays shared resources.
sharename | The network name of the shared resource and its absolute path.
/users:number | Sets the maximum number of users who can simultaneously access the shared resource.

Notes

  • XOX
  • To view the complete syntax for this command, at the command prompt, type:

    net help share

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • You can use Shared Folders to manage shared resources on both local and remote computers. For information about how to connect to another computer, see Related Topics. With Windows Explorer and the command line, you can manage shared resources on your local computer only.
  • The maximum number of users allowed is limited by software licensing limits. Software licensing limits preempt any limits that can be set in Shared Folders.
  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. http://www.microsoft.com/)

Related Topics


Configure offline settings for a shared resource

Microsoft Windows graphic

To configure offline settings for a shared resource

Using Shared Folders

  1. XOX
  2. In the console tree, click Shares.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Shares
  3. In the details pane, right-click the shared resource that you want to configure offline settings for, and then click Properties.
  4. On the General tab, click Offline Settings.
  5. In the Offline Settings dialog box, click the option that you want, and then click OK.

Note

  • XOX

Using Windows Explorer

  1. Open Windows Explorer.
  2. Right-click the shared folder or drive that you want to configure offline access for, and then click Sharing and Security.
  3. On the Sharing tab, click Offline Settings.
  4. In the Offline Settings dialog box, click the option that you want, and then click OK.

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    net share sharename /cache:manual

    or

    net share sharename /cache:documents

    or

    net share sharename /cache:programs

    or

    net share sharename /cache:none

Value | Description
net share | Manages shared resources.
sharename | The network name of the shared resource in drive:path format. To display information about a shared folder, type net share with only the share name.
/cache:manual | Allows users to manually select which documents and programs are stored offline.
/cache:documents | Automatically stores documents offline.
/cache:programs | Automatically stores documents and programs offline.
/cache:none | Prevents users from storing any files offline.

Notes

  • XOX
  • To view the complete syntax for this command, at the command prompt, type:

    net help share

Important

  • When you create a new shared resource, offline access is allowed by default, which means that secure shared resources can be stored offline on potentially insecure computers. For best security, do not allow users to store files offline. If you do, be sure to set permissions appropriately by using either share permissions or access control on the NTFS file system. For more information, see "Set permissions on a shared resource" and "Set, view, change, or remove permissions on files and folders" in Related Topics.

Notes

  • You must be logged on as a member of the Administrators group, Server Operators group, or Power Users group to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • For more information about offline files, see Related Topics.
  • For information about how to connect to another computer, see Related Topics.
  • File sharing options and offline access may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. (http://www.microsoft.com/)

Related Topics


Concepts

This section provides general background information about Shared Folders:

  • Shared Folders overview
  • Understanding Shared Folders
  • Administering Shared Folders


Shared Folders overview

You can use Shared Folders to view a summary of connections and resource use for local and remote computers. Shared Folders replaces resource-related components in Control Panel in Microsoft Windows NT® 4.0 Server.

With Shared Folders, you can:

  • Create, view, and set permissions for shared resources.
  • View a list of all users who are connected over a network to the computer and disconnect one or all of them.
  • View a list of files that are opened by remote users and close one or all of the open files.

You must be logged on as a member of the Administrators group, Server Operators group, or the Power Users group to use Shared Folders. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure. File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. http://www.microsoft.com/

For information about publishing a shared folder in Active Directory, see To publish a shared folder.

The subfolders in Shared Folders contain information, arranged in columns, about all the shared resources, sessions, and open files on the computer. If Services for Macintosh is installed, information about resources that are managed by that service may appear as well. The column headings in these folders are defined as follows:

Shares

The following table shows the information that the Shares folder contains about the shared resources that are available on the computer.

Column | Description
Share Name | Lists the shared resources that are available on the computer. In some cases, a connection to a printer is monitored here as a connection to a named pipe. A shared resource can be a shared directory, a named pipe, a shared printer, or a resource of an unrecognized type.
Folder Path | Displays the path to the shared resource.
Type | Displays the type of network connection: Windows, NetWare, or Macintosh.
# Client Connections | Displays the number of users who are connected to the shared resource.
Description | Describes the shared resource.

Sessions

The following table shows the information that the Sessions folder contains about all the network users who are connected to the computer.

Column | Description
User | Lists the network users who are connected to the computer.
Computer | Displays the computer name of the connected user's computer.
Type | Displays the type of network connection: Windows, NetWare, or Macintosh.
# Open Files | Displays the number of resources that have been opened on this computer by this user.
Connected Time | Displays the hours and minutes that have elapsed since this session was established.
Idle Time | Displays the hours and minutes that have elapsed since this user last initiated an action.
Guest | Specifies whether this user is connected to this computer as a guest (displayed as Yes or No).

Open Files

The following table shows the information that the Open Files subfolder contains about all the open files on the computer.

Column | Description
Open File | Lists the names of open files. An open file could be a file, a named pipe, a print job in a print spooler, or a resource of an unrecognized type. In some cases, a print job is shown here as an open named pipe.
Accessed By | The name of the user who has opened the file or accessed the resource.
Type | The type of network connection: Windows, NetWare, or Macintosh.
# Locks | Displays the number of application-initiated file locks on the resource.
Open Mode | Displays the permission that was granted when the resource was opened.


Understanding Shared Folders

This section covers:

  • Share permissions
  • Offline settings for shared resources
  • Special shared resources


Share permissions

A shared resource provides access to applications, data, or a user's personal data. You can assign or deny permissions for each shared resource.

You can control access to shared resources with a variety of methods. You can use share permissions, which are simple to apply and manage. Or, you can use access control on the NTFS file system, which provides more detailed control of the shared resource and its contents. You can also use a combination of these methods. If you use a combination of these methods, the more restrictive permission always applies. For example, if the share permission is set to Everyone = Read (which is the default), and the NTFS permission allows users to make changes to a shared file, the share permission applies, and the user is not allowed to change the file.

It is not always necessary to explicitly deny a permission to a shared resource. Denying permission is usually necessary only when you want to override specific permissions that are already assigned.

For information about how to set NTFS file permissions, see To set, view, change, or remove permissions on files and folders. For information about best practices for working with Shared Folders, including assigning permissions, see Best practices.

Important

  • In the Windows Server 2003 family, when you create a new shared resource, the Everyone group is automatically assigned the Read permission, which is the most restrictive.

Share permissions:

  • Apply only to users who gain access to the resource over the network. They do not apply to users who log on locally, such as on a terminal server. In these cases, use access control on NTFS to set permissions.
  • Apply to all files and folders in the shared resource. If you want to provide a more detailed level of security to the subfolders or objects in a shared folder, use access control on NTFS.
  • Are the only way to secure network resources on FAT and FAT32 volumes, because NTFS permissions are not available on FAT or FAT32 volumes.
  • Specify the maximum number of users who are allowed to access the shared resource over the network. This is in addition to the security provided by NTFS.

You can assign the following types of access permissions to shared folders or drives:

Read
Read is the default permission that is assigned to the Everyone group. Read allows:
  • Viewing file names and subfolder names
  • Viewing data in files
  • Running program files
Change
Change is not a default permission for any group. The Change permission allows all Read permissions, plus:
  • Adding files and subfolders
  • Changing data in files
  • Deleting subfolders and files
Full Control
Full Control is the default permission that is assigned to the Administrators group on the local computer. Full Control allows all Read and Change permissions, plus:
  • Changing permissions (NTFS files and folders only)


Offline settings for shared resources

You can use Offline Files to work with shared resources even when you are not connected to the network. When you create a shared resource, you can specify if and how files in the shared resource are cached (stored) locally on client computers when other users access the files.

To make shared network resources available offline, Offline Files stores a version of the shared resources in a reserved portion of disk space on the client computer, which is called a file system cache. The client computer can access this cache whether or not the client computer is connected to the network.

You can choose one of the following caching options for each shared resource:

Only the files and programs that users specify will be available offline.

This option gives users control over which files are available offline.

All files and programs that users open from the share will be automatically available offline.

This option allows all the files that users open from the shared folder to be automatically available offline.

If you select the Optimized for performance check box, all programs will be automatically cached so that they can be run locally. This option is especially useful for file servers that host applications, because it reduces network traffic and improves server scalability.

Files or programs from the share will not be available offline.

This option prevents users from storing files offline.

Important

  • When you create a new shared resource, offline access is allowed by default, which means that secure shared resources can be stored offline on potentially insecure computers. For best security, do not allow users to store files offline. If you do, be sure to set permissions appropriately using either share permissions or access control on the NTFS file system. For more information, see To set permissions on a shared resource and To set, view, change, or remove permissions on files and folders.

Offline access may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. (http://www.microsoft.com/)

For more information about Offline Files, see Offline Files overview. For more information about how to configure offline access for shared resources, see To configure offline settings for a shared resource.


Special shared resources

Depending on the configuration of your computer, some or all of the following special shared resources are created for administrative and system use. These shared resources are not visible from My Computer, but you can view them by using Shared Folders. In most cases, it is recommended that you not delete or modify special shared resources.

You can hide other shared resources from users by typing $ as the last character of the shared resource name (the $ then becomes part of the resource name). These shared folders are hidden from Windows Explorer like special shared resources, but otherwise they are not special. For more information about how to share a resource, see To share a folder or drive.

If you change permissions on special shared resources, such as ADMIN$, the default settings may be restored when the Server service is stopped and restarted or when the computer is restarted. Note that this does not apply to user-created shared resources whose share name ends in $.

You may see some or all of the following administrative shared resources in the Shares folder in Shared Folders. Other applications may create additional special shared resources. To view special shared resources in the Shares folder, see To view information about shared resources.

drive letter$
A shared resource that enables administrators to connect to the root directory of a drive.
ADMIN$
A resource that is used during remote administration of a computer. The path of this resource is always the path to the system root (the directory in which the operating system is installed, for example, C:\Windows).
IPC$
A resource that shares the named pipes that are essential for communication between programs. You use IPC$ during remote administration of a computer and when you view a computer's shared resources. You cannot delete this resource.
NETLOGON
A required resource that is used on domain controllers. Removing this shared resource causes a loss of functionality on all client computers that the domain controller serves.
SYSVOL
A required resource that is used on domain controllers. Removing this shared resource causes a loss of functionality on all client computers that the domain controller serves.
PRINT$
A resource that is used during remote administration of printers.
FAX$
A shared folder on a server that is used by fax clients in the process of sending a fax. The shared folder is used to temporarily cache files and to access cover pages that are stored on the server.


Administering Shared Folders

This section covers:

  • Securing shared resources
  • Managing Shared Folders from the command line


Securing shared resources

You can control access to shared resources with a variety of methods. You can use share permissions, which are simple to apply and manage. You can use access control on the NTFS file system, which provides more detailed control of a shared resource and its contents. You can also use a combination of these methods. If you use a combination of these methods, the more restrictive permission always applies. For example, if the share permission is set to Everyone = Read (which is the default), and the NTFS permission allows users to make changes to a shared file, the share permission applies, and the user is not allowed to change the file.

For more information about how to set NTFS file permissions, see To set, view, change, or remove permissions on files and folders. For more information about how to set share permissions, see To set permissions on a shared resource. For more information about best practices for working with Shared Folders, see Best practices.

Fixed disks on your computer, such as drive C or drive D, are automatically shared using the syntax drive letter$, such as C$ or D$. These drives do not appear with the hand icon that indicates sharing in My Computer or Windows Explorer, and they are also hidden when users connect to your computer remotely.

If your computer is not protected by a firewall, and someone knows the user name and password of any member of the Administrators group, Backup Operators group, or Server Operators group, that person has the same access to your computer as an administrator.

Important

  • To keep your drives secure, use a strong password for all accounts. For more information, see Strong passwords.
  • For best security, you can also rename the Administrator account. For more information about how to do this, see Accounts: Rename administrator account.
  • If you change permissions on special shared resources, such as ADMIN$, the default settings may be restored when the Server service is stopped and restarted or when the computer is restarted. Note that this does not apply to user-created shared resources whose share name ends in $. For more information about special shared resources, see Special shared resources.


Managing shared folders from the command line

In addition to Shared Folders and Windows Explorer, you can use the command-line utilities in the following table to manage shared resources.

Name | Use to
net file | View and control resources that are shared on the network. The Server service must be running for you to use this command.
net config | View the maximum number of users who can access a shared resource and the maximum open files per session.
net use | Connect a computer to or disconnect a computer from a shared resource.
net session | Manage server connections.
net share | Create, delete, manage, and display shared resources.
net view | Display information about the domains, computers, or resources that are shared by the specified computer, including the offline client caching settings.
net help | View help for network commands.

For information about other command-line utilities, see Command-line reference A-Z. For more information about manageability, see Management strategies and tools.


Troubleshooting

What problem are you having?

I cannot access shared resources.

Cause: The network connection was lost.

Solution: Verify network settings.

See also: Troubleshooting network and dial-up connections

Cause: Share permissions or file system permissions prevent access.

Solution: Verify that the share permissions and file system permissions on the computer to which you are connecting allow access to network resources and that you have access to these resources. If you can access Shared Folders on the remote computer, check the Sessions folder to determine the user rights with which you are logged on to the remote computer. You may be connected as Guest.

You can also verify that the Full Control permission is not denied to the Everyone group. If the Full Control permission is denied to the Everyone group, no one is able to access the shared resource, even if you grant Full Control to the Administrators group.

See also: To view information about shared resources; To set, view, change, or remove permissions on files and folders

I cannot view shared resource information in Shared Folders.

Cause: You are not logged on to the specified computer as a member of the Administrators group, Server Operators group, or Power Users group.

Solution: Log on to the specified computer with the appropriate user rights.

Note

  • File sharing options may be limited if simple file sharing is enabled. For more information about simple file sharing, see article Q304040, "Description of File Sharing and Permissions in XOX," in the Microsoft Knowledge Base. (http://www.microsoft.com/)