Windows Tip Sheet
Welcome to Win2003 SP1, Part 3
Share and share alike? Configure ABE so not everyone has access to everything.
This week’s tip is third in a four-part series of
Win2003 Service Pack 1 tips.
If you ever worked on a NetWare server—and I mean going way back to NetWare
2.x or 3.x—you know that users who didn’t have access to volumes
or folders couldn’t see them when browsing the
network. Third-party tools such as ScriptLogic’s Cloak provide similar
capabilities on Windows, but it wasn’t until Win2003 SP1 that Microsoft
finally provided it built-in. Called ABE, or Access-Based
Enumeration, the feature allows users browsing network shares to only
see those shares they have access to. If they have access to the share but not
one of its sub-folders, they won’t be able to see that sub-folder.
Of course, ABE isn’t turned on by default so you might not even be aware
of its presence. Irritatingly, you have to configure it on a per-share basis.
Even more irritatingly, there’s no GUI-based way to enable it. Jeez, guys.
I recommend grabbing a command-line utility called Shrflgs.exe
from JoeWare.net.
Run Shrflgs \\Server\Share /abe true /forreal to enable
ABE on the share \\Server\Share.
My recommendation? Write a batch file that runs this puppy against every share
you’ve got. Sure, security through obscurity is no security at all, but
if you’ve already got permissions in place, then hiding things users shouldn’t
access will help prevent them from even trying.
More Resources:
About the Author
Don Jones is a multiple-year recipient of Microsoft’s MVP Award, and is Curriculum Director for IT Pro Content for video training company Pluralsight. Don is also a co-founder and President of PowerShell.org, a community dedicated to Microsoft’s Windows PowerShell technology. Don has more than two decades of experience in the IT industry, and specializes in the Microsoft business technology platform. He’s the author of more than 50 technology books, an accomplished IT journalist, and a sought-after speaker and instructor at conferences worldwide. Reach Don on Twitter at @concentratedDon, or on Facebook at Facebook.com/ConcentratedDon.