Solved

Remove share associated permissions before deleting share

Posted on 2014-02-24
7
213 Views
Last Modified: 2014-02-27
Hello All,

me and co-worker have a bet to settle.

what happens if you delete a share before removing the associated permissions to that share? Does it affect anything? More importantly how does one tell if this has been done.
0
Comment
Question by:dfahie
  • 4
  • 3
7 Comments
 
LVL 31

Expert Comment

by:Frosty555
ID: 39883433
In Windows there are two different types of permissions and you have to be explicitly clear about which one you're talking about:

1) Share permissions, accessed by going to Properties->Sharing->Advanced Sharing->Permissions

2) Windows folder ACL, accessed by going to Properties->Security

When you delete a shared folder, the Share permissions are deleted along with it.

Windows Folder ACLs will remain.
0
 

Author Comment

by:dfahie
ID: 39883558
okay,

there is a home drive of a user that was created > right click new foler > user name > right click properties > sharing >share this folder ? type in the username with $ > hit permissions in that same window > add user with permissions.

then rigt click on the folder and go to properties > security > add same user..

so I told that is I  just right click on the home drive and delete it, there will be no trace of it?

I believe there is a way to find out if you did not remove the share permissions of that home drive before deleting it...

If this is the case then how can you tell?
0
 

Author Comment

by:dfahie
ID: 39883571
where would you go to see the ACL permissions that remaind if the folder was deleted? My impression would be there would be no where to look as the folder has been deleted.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 31

Expert Comment

by:Frosty555
ID: 39884493
The dialog box you're talking about (where you go to Right click->properties->sharing->share this folder), is just a friendly wizard that populates the "Advanced Sharing" section for you.

If you delete the entire folder the ACLs and the folder share permissions are both deleted along with it.The only way to recover that information that I know of is if you were to successfully undelete the folder using data recovery software.

If you just turn off sharing, then just the folder share permissions are deleted, but the ACLs remain (because the folder still exists).
0
 

Author Comment

by:dfahie
ID: 39884666
I agree,

there is a another system admin that told one of my other system admins that he noticed the share was deleted before the permissions were removed. He advised that you have to remove the permissions first, then delete the share. My question is how did he know that the other system administrator just deleted the share opposed to removing the permissions then deleting it... since the share is gone. I really do not think he did a restore,

Is there a log somewhere?
would there be something in the event log complaining about the permissions?

It just bothers me cause he will not tell us. I know he is not monitoring us cause he was unsure which of the 4 did it as they all use their own accounts, so that rules that out.

I want to know for myself as I like to share info.
0
 
LVL 31

Accepted Solution

by:
Frosty555 earned 175 total points
ID: 39886646
I couldn't tell you 100% that there is NO evidence anywhere on the system of the existence of the share. Perhaps there are some event logs or metadata elsewhere on the system that might allude to the shared folder's existence and could be used to forensically determine if the share existed or what it's permissions were.

.... but it definitely doesn't matter for any practical reason. There certainly is no practical difference between delete the share permissions first before deleting the folder vs just deleting the folder. When Windows deletes the folder it unshares it as part of the process of deleting the folder. The end result is exactly the same.

The admin isn't making any sense to me, it sounds like he's fussing over nothing. Or maybe I'm not hearing the whole story.
0
 

Author Comment

by:dfahie
ID: 39891016
I think you are right, he is fussing over nothing. I did talk to him and it took some time to get it out of him but how he found out was when he rebooted the server, it tried to map the share on boot up and then is when it started to complain.. I cannot see this happening but I could be wrong. Does this make sense?
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Outline Suppose you have some simple text based data in Excel that you would like to display as a PowerPoint presentation. Of course it would be possible to write some fairly complex VBA code that created a new slide for each line of the Excel data…
As freelancing is becoming more and more common in the tech industry, certain obstacles are proving to be a challenge to those who are used to more traditional, structured employment. This article is meant to help identify such obstacles and offer a…
The view will learn how to download and install SIMTOOLS and FORMLIST into Excel, how to use SIMTOOLS to generate a Monte Carlo simulation of 30 sales calls, and how to calculate the conditional probability based on the results of the Monte Carlo …
The viewer will learn how to create two correlated normally distributed random variables in Excel, use a normal distribution to simulate the return on different levels of investment in each of the two funds over a period of ten years, and, create a …

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now