asked on

Permit Everyone Access to a Windows 2003 Shared Folder

This one is driving me nuts! I have several Windows XP Pro clients on a workgroup with a Windows 2003 Server. I have a shared folder on the 2003 server that I would like everyone to be able to access without being prompted for a password. The problem is that I always get prompted for a username/password despite the settings I've changed. I've trawled the net and found people with similar problems but no solutions.

The folder in question has share and NTFS permissions set for the Everyone group. The server has the "Let everyone permissions apply to anonymous users" policy enabled, the Everyone group is included in the "Access this computer from the network" policy, the guest account is enabled and has a password set. I've toyed with all the other relevant settings I can find but nothing seems to help.

Your help will be greatly appreciated!

Thanks,
D.

Lee W, MVP

Any reason you're not using a domain?

ASKER CERTIFIED SOLUTION

Steve Agnew

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Steve Agnew

Note above comment: your server can have access to GET to the internet, just make sure that internet users can't GET to it *FROM* the internet.. Another reason for not enabling the guest account is that it allows people to access accounts and such on your servers and you can't log it. If you are concerned about your users on your network hacking your server youre back to the nightmare of creating each and every account and making sure passwords match for each user.. if you haven't even enabled the logging of access to your server then you wouldn't have any logs to look at anyway. Security is complicated in our current IT world, but you just have to look at the risks basis the gain.. if you aren't worried about hackers and you can't get to your server *FROM* the internet then enabling the guest account is your best solution. Feel free to give more specific information as to how the server is used and it's connected and I can be more specific.. I'm having to guess to give you this information...

_KeepItSimple_

ASKER

It wasn't my decision to not use a domain (I have a limited say on the infrastructure) although we do have plans to move to a domain in the future.

Thanks very much for you help so far. I'll have another go next time I'm in the office and let you know how I get on.

_KeepItSimple_

ASKER

On second thoughts, I'll give you some background as I'm not sure I'm doing this for the right reasons.

I have a VBScript file that maps network drives etc using a common username/password and would like this script to run on each client machine at logon. Rather than have the script duplicated on each client, I thought it would be better to have the script on the server and each client access that copy when required.

Each client has a logon script that does nothing but call the script on the server. However, the client scripts fail because access is denied when they attempt to access the share on the server. Hence, my original question was in an effort to get anonymous access to the share containing the central script.

I hope this makes sense. I know that a domain controller is the ideal solution, but that option isn't available to me at the moment. Let me know if I'm going about this all wrong.

Thanks,
D.

Steve Agnew

In your current situation is about the only time you would want to use the guest account. Like I said, that is why it exists, you don't care who or why they access it (just make sure the access for guest is READ ONLY) so users or a virus they might get can't change it. This is perfect for you, once you get a domain controller you can disable the guest account and configure it with a higher security. Like I said everyone is so afraid of the guest account because it used to give 'access to everything' now it only gives access to what you configure it to. You may even have difficulty getting it to work at first as Microsoft wants to make da** sure you want to give them access .. they shouldn't have an account with the same name on the server .. if they do their machine is probably going to try that and if it's different they will get access denied.. The DC will make all of this unnecessary, but until you have one and you want to give people access to something without having them login- that is why GUEST exists...

negativelocity

If you create a mapped network drive on each computer I believe that it will allow you to save that username and password and for it to automatically be used whenever accessed. or is that your problem, that it won't retain the password?

-nV

Steve Agnew

The login script runs before drives are mapped I'm pretty sure.. anyway the guest account exists for what he is trying to do and it's only a makeshift until they bring a domain controller online.. I would almost bet that if you called Microsoft and paid them the whatever their calls go for now they would tell you the same thing... enable the guest and account .. give it NTFS access and Share level read only access to the folder and call it a day...

_KeepItSimple_

ASKER

Thanks very much for your help! I've managed to get it working using the guest account. I'm still unsure as to why giving the Everyone group access to the share didn't work. If I explicitly give the guest account access (as recommended by DeadNight) then it lets anonymous users in no probs.

It certainly seems that 2003 Server is very reluctant to allow blanket access to a share!

I have yet to check that the security does not over-expose us to the internet but will do this very soon.

Thanks,
D.