Tech Line

Setting the Security tab Free

Can't seem to find the Security tab in order to set NTFS permissions in Windows XP? Not all is as it appears.

Chris: I'm trying set up file sharing in a workgroup that consists of 10 computers running Windows XP Professional. I'm trying to set up shares on one system and give some users write access to the shares, while giving other users read access to the shares. I'd like to set both Share and NTFS permissions, but can't seem to find the Security tab in order to set the NTFS permissions. Is there a new way to set the NTFS permissions in Windows XP Professional?
—Tony

Tony: Your question was actually originally answered by Mr. Miyagi in the first Karate Kid movie. In the movie he stated "Not everything is as seem." In Windows XP Professional configured in a workgroup environment, the Security tab is available when you access the properties of a file or folder, only you just won't see it.

If you want to see the Security tab, you need to tell Windows to show it to you. To do so, follow these steps:

  1. Go to Windows Explorer, and then click on the Tools menu and select Folder Options.
  2. Click on the View tab and then scroll down to the bottom of the Advanced Settings portion of the Folder Options dialog box.
  3. Clear the "Use Simple File Sharing" checkbox and click OK.

Of course, NTFS permissions are only visible on NTFS volumes, so if your volume is formatted as FAT, you still won't see the Security tab.

Tech Help—Just An
E-Mail Away

Got a Windows, Exchange or virtualization question or need troubleshooting help? Or maybe you want a better explanation than provided in the manuals? Describe your dilemma in an e-mail to the MCPmag.com editors at mailto:editor@mcpmag.com; the best questions get answered in this column; MCPmag.com baseball caps go to the published submitter.

When you send your questions, please include your full first and last name, location, certifications (if any) with your message. (If you prefer to remain anonymous, specify this in your message but submit the requested information for verification purposes.)

For those of you out there with XP Home workgroups, you may find that you're not even seeing the "Use Simple File Sharing" checkbox. This is because with XP Home the Security tab cannot be displayed for logged on users by default. This is also attributed to the influence of Mr. Miyagi. When asked by Microsoft about what to do with security and XP Home, Miyagi offered "If whole life have balance, everything will be better." So to balance XP Home with XP Pro, it was thought that no access to the Security tab for normal XP Home users would create that balance.

OK, well maybe Miyagi didn't have as much to do with XP as I'm giving him credit for, but it is true that, by default, logged on users will not see a Security tab, even on NTFS volumes. However, you do have a couple of options to bring the Security tab to life with XP Home.

The first option is to reboot into Safe Mode. In Safe Mode, you'll see the Administrator account displayed in the logon screen. If you logon as Administrator you will then be able to access the Security tab under a file or folder object's properties in Windows Explorer. If you want to make the tab available for all user's all the time, Gilles Pion described an excellent method to do this at dougknox.com.

Note that in a domain environment, the Security tab is visible when logging onto XP Professional workstations joined to the domain. If you want to hide it from users, you can do so using a Group Policy Object. Here's how you would create a new GPO that would prevent users from viewing the Security tab for all file systems:

  1. To edit an existing GPO, open the GPO that applies to the users you wish to deny Security tab access to and skip to Step 7. If you want to create a new GPO to deny access to the Security tab, go to Step 2.
  2. Click Start, Administrative Tools, Active Directory Users and Computers.
  3. Right click on the object that you want to link the new GPO to (domain, OU, etc.), and select Properties.
  4. In the Properties dialog box, click the Group Policy tab and then click the New button.
  5. Enter a name for the new GPO and hit Enter.
  6. With the new GPO highlighted, click the Edit button.
  7. With the GPO open, navigate to User Configuration, Administrative Templates, Windows Explorer.
  8. Now double-click on the Remove Security Tab setting. In the setting properties dialog box, click Enabled and then click OK.
  9. Close the Group Policy Object Editor.
  10. In the Domain or OU properties dialog box that should be currently displayed, click the Properties button. This will allow you to set the permissions for the GPO.
  11. Verify that the user groups that should not see the Security tab in Windows Explorer have both Read and Apply Group Policy permissions for the GPO.

I know, your situation involved just an XP Professional workgroup, but I thought that describing how to change the default domain behavior was important too.

[Chris Wolf has just released Virtualization: From the Desktop to the Enterprise (Apress) and also welcomes your virtualization questions for this column. —Editors]

About the Author

Chris Wolf is a Microsoft MVP for Windows --Virtual Machine and is a MCSE, MCT, and CCNA. He's a Senior Analyst for Burton Group who specializes in the areas of virtualization solutions, high availability, storage and enterprise management. Chris is the author of Virtualization: From the Desktop to the Enterprise (Apress), Troubleshooting Microsoft Technologies (Addison Wesley), and a contributor to the Windows Server 2003 Deployment Kit (Microsoft Press).learningstore-20/">Troubleshooting Microsoft Technologies (Addison Wesley) and a contributor to the Windows Server 2003 Deployment Kit (Microsoft Press).

comments powered by Disqus

SharePoint Watch

Sign up for our newsletter.

I agree to this site's Privacy Policy.