SHARING FILE SYSTEM RESOURCES

1. Chapter 9 SHARING FILE SYSTEM RESOURCES

2. Chapter 9: SHARING FILE SYSTEM RESOURCES CHAPTER OVERVIEW • Create and manage file system shares and work with share permissions. • Use NTFS file system permissions to control access to files. • Manage file sharing using Internet Information Services (IIS).

3. Chapter 9: SHARING FILE SYSTEM RESOURCES UNDERSTANDING PERMISSIONS • File system permissions • Share permissions • Active Directory permissions • Registry permissions

4. Chapter 9: SHARING FILE SYSTEM RESOURCES ACCESS CONTROL LISTS

5. Chapter 9: SHARING FILE SYSTEM RESOURCES PERMISSIONS

6. Chapter 9: SHARING FILE SYSTEM RESOURCES INHERITANCE • Allows permissions assigned at one folder to flow down to subsequent files and folders • Can be overridden by explicit permission assignment or inheritance blocking • Useful in reducing the number of permission assignments required

7. Chapter 9: SHARING FILE SYSTEM RESOURCES EFFECTIVE PERMISSIONS • Allowed permissions are cumulative. • Denied permissions override allowed permissions. • Explicit permissions take precedence over inherited permissions.

8. Chapter 9: SHARING FILE SYSTEM RESOURCES SHARING FOLDERS

9. Chapter 9: SHARING FILE SYSTEM RESOURCES ADMINISTRATIVE SHARES

10. Chapter 9: SHARING FILE SYSTEM RESOURCES RESTRICTIONS ON CREATING FILE SYSTEM SHARES • On a domain controller: Administrators, Server Operators, Enterprise Admins, Domain Admins groups only • On a domain member server or workstation: Administrators, Server Operators, or Power Users groups only • On a workgroup or standalone computer: Administrators or Power Users groups only

11. Chapter 9: SHARING FILE SYSTEM RESOURCES CREATING A FILE SYSTEM SHARE USING WINDOWS EXPLORER

12. Chapter 9: SHARING FILE SYSTEM RESOURCES SHARING A VOLUME USING WINDOWS EXPLORER

13. Chapter 9: SHARING FILE SYSTEM RESOURCES CREATING A FILE SYSTEM SHARE USING THE SHARED FOLDERS SNAP-IN

14. Chapter 9: SHARING FILE SYSTEM RESOURCES CREATING A FILE SYSTEM SHARE USING NET.EXE • Allows shares to be created from a command line • Lets you configure permissions during creation • Lets you configure offline settings for the share

15. Chapter 9: SHARING FILE SYSTEM RESOURCES MANAGING SHARED FOLDERS

16. Chapter 9: SHARING FILE SYSTEM RESOURCES CONTROLLING OFFLINE STORAGE

17. Chapter 9: SHARING FILE SYSTEM RESOURCES PUBLISHING FILE SYSTEM SHARES IN ACTIVE DIRECTORY

18. Chapter 9: SHARING FILE SYSTEM RESOURCES MANAGING SHARE PERMISSIONS

19. Chapter 9: SHARING FILE SYSTEM RESOURCES USING SHARE PERMISSIONS • Limited scope Can be applied only to folders and only when connecting to the share. • Lack of flexibility Permissions applied to the share apply to all levels below. • No replication Share permissions are not replicated. • No resiliency Share permissions cannot be backed up or restored.

20. Chapter 9: SHARING FILE SYSTEM RESOURCES USING SHARE PERMISSIONS (continued) • Fragility Shares (and therefore share permissions) are lost when a folder is moved or renamed. • No auditing Share permissions do not facilitate auditing.

21. Chapter 9: SHARING FILE SYSTEM RESOURCES SHARE PERMISSION DEFAULTS • When a new share is created, the following permissions are granted: • Everyone special identity: Read • Administrators: Full Control

22. Chapter 9: SHARING FILE SYSTEM RESOURCES CREATING A FILE SYSTEM SHARING STRATEGY • Create logically named shares. • Use nesting where necessary to reduce users’ need to navigate the directory structure. • Share removable drives from the root to keep the share available when media are removed and reconnected or changed.

23. Chapter 9: SHARING FILE SYSTEM RESOURCES NESTING SHARES • A share can be created on any folder in the file system. • Multiple shares on the same folder can have different permissions. • Permissions are applied at the share entry point.

24. Chapter 9: SHARING FILE SYSTEM RESOURCES USING NTFS PERMISSIONS • Scope NTFS permissions apply no matter how the file is accessed. • Flexibility Wide range of permissions allows assignments to be tailored. • Replication NTFS permissions are included when a file is replicated. • Resilience NTFS permissions are retained when objects are backed up. • Less fragile NTFS permissions are not lost if a file is moved or renamed. • Auditing NTFS permissions support auditing.

25. Chapter 9: SHARING FILE SYSTEM RESOURCES MANAGING STANDARD PERMISSIONS

26. Chapter 9: SHARING FILE SYSTEM RESOURCES USING ADVANCED SECURITY SETTINGS

27. Chapter 9: SHARING FILE SYSTEM RESOURCES MANAGING SPECIAL PERMISSIONS

28. Chapter 9: SHARING FILE SYSTEM RESOURCES VIEWING EFFECTIVE PERMISSIONS

29. Chapter 9: SHARING FILE SYSTEM RESOURCES RESOURCE OWNERSHIP • Each file and folder is assigned an owner. • Ownership of a file makes the security principle a member of the Creator/Owner special identity. • Files that are owned go toward disk quota calculations.

30. Chapter 9: SHARING FILE SYSTEM RESOURCES ADMINISTERING IIS • Web server platform included with all editions of Windows Server 2003. • Version 6 has improved security over previous versions. • Allows files to be published through a browser interface. • Supports HTTP and FTP.

31. Chapter 9: SHARING FILE SYSTEM RESOURCES INSTALLING IIS • Not installed during operating system installation • Installed through the Windows Components Wizard (select Add Or Remove Programs in Control Panel, and click Add/Remove Windows Components) or through the Manage Your Server Wizard

32. Chapter 9: SHARING FILE SYSTEM RESOURCES MANAGING AN IIS WEB SITE

33. Chapter 9: SHARING FILE SYSTEM RESOURCES USING THE WEB SITE TAB

34. Chapter 9: SHARING FILE SYSTEM RESOURCES USING THE HOME DIRECTORY TAB

35. Chapter 9: SHARING FILE SYSTEM RESOURCES USING THE DOCUMENTS TAB

36. Chapter 9: SHARING FILE SYSTEM RESOURCES USING THE PERFORMANCE TAB

37. Chapter 9: SHARING FILE SYSTEM RESOURCES CREATING VIRTUAL DIRECTORIES • Allows you to include a folder from anywhere on the network in your Web site • Appears to the Web site user as if it is a subdirectory of the main Web site folder • Allows management of Web content to be distributed between departments

38. Chapter 9: SHARING FILE SYSTEM RESOURCES CONFIGURING IIS SECURITY

39. Chapter 9: SHARING FILE SYSTEM RESOURCES CONFIGURING IIS AUTHENTICATION

40. Chapter 9: SHARING FILE SYSTEM RESOURCES CONFIGURING IP ADDRESS AND DOMAIN NAME RESTRICTIONS

41. Chapter 9: SHARING FILE SYSTEM RESOURCES CONFIGURING SECURE COMMUNICATIONS

42. Chapter 9: SHARING FILE SYSTEM RESOURCES SUMMARY • Windows Server 2003 controls access to resources using a number of mechanisms, including share permissions and NTFS permissions. • Every object protected by permissions has an ACL, which is a list of ACEs assigned to that object. Each ACE contains a security principal and indicates the level of access they are permitted or denied to the object. • File system shares enable network users to access files and folders on other computers.

43. Chapter 9: SHARING FILE SYSTEM RESOURCES SUMMARY (continued) • Share permissions provide basic protection for file system shares, but they lack the granularity and flexibility of NTFS permissions. • NTFS permissions can be allowed or denied, and explicit or inherited. A Deny permission takes precedence over an Allow permission, and an Explicit permission takes precedence over an Inherited permission.

44. Chapter 9: SHARING FILE SYSTEM RESOURCES SUMMARY (continued) • Access granted by NTFS permissions can be restricted by share permissions and other factors, such as IIS permissions on Web sites. • Whenever two permission types are assigned to a resource, you must evaluate each set of permissions and then determine which of the two is more restrictive. • Every NTFS file and folder has an owner. The owner of a file or folder is always permitted to modify the file or folder’s ACL.

45. Chapter 9: SHARING FILE SYSTEM RESOURCES SUMMARY (continued) • Any user with the Allow Take Ownership permission or the Take Ownership Of Files Or Other Objects user right can take ownership of an object. • IIS is a Windows Server 2003 application that allows you to share files and folders using Web and FTP server services.