Folders can be shared on FAT, FAT32, and NTFS volumes. When a folder is shared, as stated earlier, share options can be configured, including the share name, description, share permissions, access-based enumeration, limiting the number of simultaneous connections, the default offline file settings, and BranchCache if the service is already installed on the Windows Server 2008 R2 system. There are many ways to create a share, but to provide the most functionality during the share creation task, administrators should use the Share and Storage Management console located in Server Manager. The Share and Storage Management console can be used to create shares and provision storage, including tasks such as creating volumes on existing Windows disks. To create a new share using the Share and Storage Management console, perform the following steps:
1. Log on to the Windows Server 2008 R2 system with an account with administrator privileges.
2. Click Start, click All Programs, click Administrative Tools, and select Server Manager.
3. Double-click on Roles, and then double-click on File Services.
4. Select Share and Storage Management.
5. In the Actions pane, click Provision Share to invoke the Provision a Shared Folder Wizard.
6. For this example, a new folder called HumanResources will be created and shared on the C: drive. Type c:\HumanResources in the location area, and click Next.
7. A pop-up window opens, stating that the folder does not exist; click Yes to create the folder.
8. On the NTFS Permissions page, select the No, Do Not Change NTFS Permissions option button, and click Next to continue. If desired, click to change the permissions and add the Human Resources department members or security groups to limit access to the share.
9. On the Share Protocols page, select the SMB protocol to share the folder to Windows and other compatible SMB clients, type in the name of the share if the default is not desired, and click Next to continue. If the Services for NFS is installed, the administrator can also enable the NFS protocol for this share by checking the NFS check box and entering a share name.
10. On the SMB Settings page, click the Advanced button to configure the advanced share settings.
11. In the Advanced Settings window, select the User Limits tab to configure the maximum number of connections to the share and check the Enable Access-based Enumeration check box.
12. On the Caching tab, select the No Files or Programs from the Share Are Available Offline option button, and click OK. Because we are sharing a folder that will contain Human Resources data, users should only be able to access the folders and files when connected to the company network and that is why we are disabling caching. Also, due to the secure nature of some Human Resources data, we have also enabled access-based enumeration to ensure that the users who do not have access to the data do not even see the folders or files hosted within the share.
13. Back on the SMB Settings page, click Next to continue.
14. On the SMB Permissions page, select the Administrators Have Full Control; All Other Users and Groups Have Only Read Access option button, and click Next. This permission setting is preferred on some networks to allow administrators to upload new data to the share from the network to simplify administration. If tighter security is required, as would be typical with a Human Resources folder, the administrator can select the users and groups that have custom share permissions and configure the permissions to allow only the network administrators and Human Resources department members access to the share.
15. If the File Server Resource Manager is installed, the Quota Policy page is displayed. On the Quota Policy page, configure the Apply Quota check box as necessary, and click Next to continue.
16. If the File Server Resource Manager is installed, the File Screen Policy page is displayed on the next page. On the File Screen Policy page, configure the Apply File Screen check box as necessary, and click Next to continue.
17. On the DFS Namespace Publishing page, clear the check box, and click Next to continue.
18. On the Review Settings and Create Share page, review the chosen settings and if everything appears correct, click Create to continue.
19. The Confirmation page is displayed to show the results of the share creation. Click Close to complete the share creation.
Using the Share and Storage Management console on Windows Server 2008 R2 systems with the File Server Resource Manager (FSRM) installed enables administrators to fully configure a share’s properties and security settings. That is why no file server should be deployed without the FSRM and why shares should only be created using the Share and Storage Management console.
As a best practice, always define share permissions for every share regardless of the volume format type. When a share is first created using the Share and Storage Management console, the administrator is provided three standard permissions configuration options as well as the ability to customize the permissions. The three preconfigured permissions options use the local Administrators group and the Everyone group for share permissions.
Using any of the three preconfigured settings and not customizing permissions might not be acceptable for companies that must adhere to strict security requirements as the Everyone group can enable guest and anonymous share access and viewing. Even though the guest account is disabled by default, and anonymous access is disabled by default, using a best-practice recommendation is to always replace the Everyone group with at least the Authenticated Users, local server Users, or Domain Users group to require authentication before accessing a share.
1. Log on to the Windows Server 2008 R2 system with an account with administrator privileges.
2. Click Start, click All Programs, click Administrative Tools, and select Server Manager.
3. Double-click on Roles, and then double-click on File Services.
4. Select Share and Storage Management.
5. In the Actions pane, click Provision Share to invoke the Provision a Shared Folder Wizard.
6. For this example, a new folder called HumanResources will be created and shared on the C: drive. Type c:\HumanResources in the location area, and click Next.
7. A pop-up window opens, stating that the folder does not exist; click Yes to create the folder.
8. On the NTFS Permissions page, select the No, Do Not Change NTFS Permissions option button, and click Next to continue. If desired, click to change the permissions and add the Human Resources department members or security groups to limit access to the share.
9. On the Share Protocols page, select the SMB protocol to share the folder to Windows and other compatible SMB clients, type in the name of the share if the default is not desired, and click Next to continue. If the Services for NFS is installed, the administrator can also enable the NFS protocol for this share by checking the NFS check box and entering a share name.
10. On the SMB Settings page, click the Advanced button to configure the advanced share settings.
11. In the Advanced Settings window, select the User Limits tab to configure the maximum number of connections to the share and check the Enable Access-based Enumeration check box.
12. On the Caching tab, select the No Files or Programs from the Share Are Available Offline option button, and click OK. Because we are sharing a folder that will contain Human Resources data, users should only be able to access the folders and files when connected to the company network and that is why we are disabling caching. Also, due to the secure nature of some Human Resources data, we have also enabled access-based enumeration to ensure that the users who do not have access to the data do not even see the folders or files hosted within the share.
13. Back on the SMB Settings page, click Next to continue.
14. On the SMB Permissions page, select the Administrators Have Full Control; All Other Users and Groups Have Only Read Access option button, and click Next. This permission setting is preferred on some networks to allow administrators to upload new data to the share from the network to simplify administration. If tighter security is required, as would be typical with a Human Resources folder, the administrator can select the users and groups that have custom share permissions and configure the permissions to allow only the network administrators and Human Resources department members access to the share.
15. If the File Server Resource Manager is installed, the Quota Policy page is displayed. On the Quota Policy page, configure the Apply Quota check box as necessary, and click Next to continue.
16. If the File Server Resource Manager is installed, the File Screen Policy page is displayed on the next page. On the File Screen Policy page, configure the Apply File Screen check box as necessary, and click Next to continue.
17. On the DFS Namespace Publishing page, clear the check box, and click Next to continue.
18. On the Review Settings and Create Share page, review the chosen settings and if everything appears correct, click Create to continue.
19. The Confirmation page is displayed to show the results of the share creation. Click Close to complete the share creation.
Using the Share and Storage Management console on Windows Server 2008 R2 systems with the File Server Resource Manager (FSRM) installed enables administrators to fully configure a share’s properties and security settings. That is why no file server should be deployed without the FSRM and why shares should only be created using the Share and Storage Management console.
As a best practice, always define share permissions for every share regardless of the volume format type. When a share is first created using the Share and Storage Management console, the administrator is provided three standard permissions configuration options as well as the ability to customize the permissions. The three preconfigured permissions options use the local Administrators group and the Everyone group for share permissions.
Using any of the three preconfigured settings and not customizing permissions might not be acceptable for companies that must adhere to strict security requirements as the Everyone group can enable guest and anonymous share access and viewing. Even though the guest account is disabled by default, and anonymous access is disabled by default, using a best-practice recommendation is to always replace the Everyone group with at least the Authenticated Users, local server Users, or Domain Users group to require authentication before accessing a share.
No comments:
Post a Comment