Share Permissions

When users access files on a Windows Server 2003, they usually do so across the network, especially if you restrict who's allowed to log on to the server and limit physical access to the machine. Therefore, most users who access files on a Windows Server 2003 do so through a network share , which is a directory on a Windows Server 2003 that you've shared to the network for public access.

Shares are also objects for Windows 2003, so permissions do apply. The list of applicable permissions consists of the following three entries, which are managed in the same Allow/Deny method as the direct NTFS object permissions:

• Read permits viewing of files in the share, loading of files across the network, and program execution.

• Change includes all Read permissions, plus creating, deleting, or changing directories and files within the share.

• Full Control includes all Change permissions plus changing permissions for and taking ownership of the share.

No Special Access exists for shares. Table 16-1 summarizes the basic permissions for shares.

 

Table 16-1: Share Permissions and Basic Permissions

File	Read	Write	Execute	Delete	Change
Read	X		X
Change	X	X	X	X
Full Control	X	X	X	X	X

Tip 

If you want to expose the contents of a FAT partition on a Windows Server 2003 to network users, doing so through a share automatically gives you some degree of access control, which is yet another advantage to using a network!

KEY CONCEPT 

To create a share, right-click a directory in My Computer or Windows 2003 Explorer, and then choose Sharing and Security. The Properties window for that directory appears with the Sharing tab selected, as shown in Figure 16-2.

Figure 16-2: The Sharing tab provides easy access to a share's name , user limits, permissions, and caching settings.

The following elements of this window relate to creating and managing shares:

• Share This Folder: You must select the Share This Folder option to enable sharing on a directory or folder.

• Share Name: By default, a share's name is the same as the directory from which it comes. When creating shares, remember that DOS and Windows 3. x users can only access shares with names that are a maximum of eight characters long.

• User Limit: The User limit pane lets you limit how many users can access a share simultaneously . This will usually be a concern only on a heavily loaded Windows 2003 Server; in most cases, you can leave it set to the Maximum allowed default.

• Permissions button: You control share permissions through the Permissions button at the lower right of the Sharing tab. These permissions work the same way as NTFS permissions.

• Offline Settings button: This button allows you to enable or disable the ability of remote users to cache the contents of this share on their local systems through Offline Files and Folders. By default, only the files and programs specified by users are available offline.