Network Shared Folder Configuration

[RoboX]

Hi guys, I need some advice on how to configure sharing a folder over the network. The network consists of 3 Pcs with Windows operating system, connected to the same router. One of the three Pc will have to host a folder with some files to share with the other two Pc.

My doubts are as follows:

1) If I leave the password-protected sharing setting off from the advanced sharing settings of Windows, in terms of security and privacy, is it easy to find the shared folder from a PC (that is not part of the three Pcs that need to access the folder) that connects to the router or even from the outside?

2) If I activate the password protection above, does this ensure the safety of the working environment or does it need anything else?

3) if I activate the password, what should I enter as username and password when I try to access the folder from other Pc (the PC hosting the folder does not have a password on startup, if it is the one you should enter) ?

 

[kayjay010101]

Hi guys, I need some advice on how to configure sharing a folder over the network. The network consists of 3 Pcs with Windows operating system, connected to the same router. One of the three Pc will have to host a folder with some files to share with the other two Pc.

My doubts are as follows:

1) If I leave the password-protected sharing setting off from the advanced sharing settings of Windows, in terms of security and privacy, is it easy to find the shared folder from a PC (that is not part of the three Pcs that need to access the folder) that connects to the router or even from the outside?

2) If I activate the password protection above, does this ensure the safety of the working environment or does it need anything else?

3) if I activate the password, what should I enter as username and password when I try to access the folder from other Pc (the PC hosting the folder does not have a password on startup, if it is the one you should enter) ?

1)
Yes, all that is needed is the IP. To access the files all that would be needed is to type \\IP\ into the file explorer and you'd get right in. Most IP scanning tools even show Windows shares automatically if it finds them, so even if an attacker wasn't aware of there being any shares all it would take is 2 clicks and 30 seconds with free software like Advanced IP scanner.
2)
All it ensures is another hurdle for access. For "full" protection you'd set appropriate permissions per file, encryption, backup in case of ransomware, etc., but as this isn't a production environment, all that's necessary is a password. You're not going to be sharing mission-critical data, hopefully, and so attackers aren't going to be plentiful unlike if you were, say, Google.
3)
I haven't messed with Windows 10 sharing in a while so I'm not 100% sure, but if it's anything like SMB shares on Windows Server you'd authenticate using an account with privileges to the share, so most likely the account the files are being shared from. The username would then be the username of the account the sharing computer is logged in as, and the password would be that account's password. You might be able to add Microsoft Accounts to the list of authenticated users (I know you can with SMB shares), but seeing as you mention the account doesn't have a password, it's a local one and not a Microsoft Account.

 

[SenditMakine]

1)
Yes, all that is needed is the IP. To access the files all that would be needed is to type \\IP\ into the file explorer and you'd get right in. Most IP scanning tools even show Windows shares automatically if it finds them, so even if an attacker wasn't aware of there being any shares all it would take is 2 clicks and 30 seconds with free software like Advanced IP scanner.
2)
All it ensures is another hurdle for access. For "full" protection you'd set appropriate permissions per file, encryption, backup in case of ransomware, etc., but as this isn't a production environment, all that's necessary is a password. You're not going to be sharing mission-critical data, hopefully, and so attackers aren't going to be plentiful unlike if you were, say, Google.
3)
I haven't messed with Windows 10 sharing in a while so I'm not 100% sure, but if it's anything like SMB shares on Windows Server you'd authenticate using an account with privileges to the share, so most likely the account the files are being shared from. The username would then be the username of the account the sharing computer is logged in as, and the password would be that account's password. You might be able to add Microsoft Accounts to the list of authenticated users (I know you can with SMB shares), but seeing as you mention the account doesn't have a password, it's a local one and not a Microsoft Account.

Yeah not much to say except from what was being said here, only thing to add is that in 3) yes you authenticate with the main account of the computer, but if you create another local admin account on that computer you can also authenticate with this new user's credentials. If you're all part of the same windows workgroup there are even more ways to setup this.
Here's a link explaining the same thing you're asking with plenty of data and explanations(unfortunately on windows 7, but the key concept is the same)
Also, he is right about the 2) if it's not sensible information and you're not in work environment there's no need for all that concern (don't get me wrong, you're obviously be safer with more security, just saying that it probably won't be that much) just a password will get you fine

 

[Deeveo]

Yeah not much to say except from what was being said here, only thing to add is that in 3) yes you authenticate with the main account of the computer, but if you create another local admin account on that computer you can also authenticate with this new user's credentials. If you're all part of the same windows workgroup there are even more ways to setup this.
Here's a link explaining the same thing you're asking with plenty of data and explanations(unfortunately on windows 7, but the key concept is the same)
Also, he is right about the 2) if it's not sensible information and you're not in work environment there's no need for all that concern (don't get me wrong, you're obviously be safer with more security, just saying that it probably won't be that much) just a password will get you fine

If you create an account just for using it to access the share remotely, it doesn't need to be a local admin. And actually it shouldn't be, a regular user is enough. You just need to set proper folder permissions on the shared folder, depending on the type of access you need to the files on the folder you are sharing.

 

[SenditMakine]

If you create an account just for using it to access the share remotely, it doesn't need to be a local admin. And actually it shouldn't be, a regular user is enough. You just need to set proper folder permissions on the shared folder, depending on the type of access you need to the files on the folder you are sharing.

Yeah, my bad, I always forget about this, any account you create you can just go to the folder properties>security and then add the user (I even think that you don't even need to create the account, if you're on the same workgroup it should act as a domain and seek users from other computers in the same workgroup that are in your network, that is if you allow your computer to share information o local network, but that's just speculation, I don't know for sure if that works)

 

[Deeveo]

WOW, Microsoft really has dumbed down the user control ability in Windows 10. Haven't really had to play around with these in a while, but basicly only thing you can set about a user account now is if it is a regular user or a admin. Maybe you need Enterprise version to have more access.

Edit. I mean you can't change what user groups the account belongs to etc. So you could make account that can remotely access a folder, but can't be used to log into computer etc. Now you need to add registry entry for each account name to hide it from login screen.

Edit2. Scratch that. You can actually manage these from launching lusrmgr.msc from windows key + r (run). They really make a lot of effort to hide everything now.

Hi guys, I need some advice on how to configure sharing a folder over the network. The network consists of 3 Pcs with Windows operating system, connected to the same router. One of the three Pc will have to host a folder with some files to share with the other two Pc.

My doubts are as follows:

1) If I leave the password-protected sharing setting off from the advanced sharing settings of Windows, in terms of security and privacy, is it easy to find the shared folder from a PC (that is not part of the three Pcs that need to access the folder) that connects to the router or even from the outside?

2) If I activate the password protection above, does this ensure the safety of the working environment or does it need anything else?

3) if I activate the password, what should I enter as username and password when I try to access the folder from other Pc (the PC hosting the folder does not have a password on startup, if it is the one you should enter) ?

You can leave password protection on. Launch lusrmgr.msc from run command (Windows key + r). Create a new user for accessing the shared folder, name with whatever you like, and give it a password (untick the box that user needs to change password and set it to never expire). Right click on the newly created user and go to the Member Of tab on the user settings, remove the Users group from this new user (this makes it so that you won't be able to login to this computer locally with this user, and account will not show on login screen).

If you already created the share (or create the share), add this new user from permission tab on sharing settings for the shared folder with appropriate permissions. You can remove everyone from having permissions, which is default.

From the remote computer you should see this new share, if network discovery is on and you are on the same network. Use the new new username and password you just created on the computer with the share to log into the shared folder. You can also link this share as a network drive from file explorer. Open file explorer, find This (My) Computer from the left tab, then click on connect to a network drive from the top bar. Tick on connect as different user and remember password, and give the new user and password.

Create a different user(s) for each connecting computer, if you need to set different permissions etc. For remote access from outside off your local network, you would propably need some kind of VPN or other tunneling setup, which I'm not really familiar with.

If you use Microsoft account, and use the same account to logon to each computer, then you shouldn't need to set local user account(s) at all.

Edit. Oh was meant as a new post.

Edit. You can also use \\computer name\share name, to connect to the share instead of \\IP address\share name when you are on same network/workgroup. This way it will always find the share even if your IP changes due to dynamic DHCP (if you didn't set static IP address for your computer).

 

[SenditMakine]

Edit. You can also use \\computer name\share name, to connect to the share instead of \\IP address\share name when you are on same network/workgroup. This way it will always find the share even if your IP changes due to dynamic DHCP (if you didn't set static IP address for your computer)

Yeah, connection by hostname is always better

 

[RoboX]

Thank you very much for the information.

Is it necessary to set the IP of the PC hosting the folder as static or can I leave all the default settings?

 

[Deeveo]

Thank you very much for the information.

Is it necessary to set the IP of the PC hosting the folder as static or can I leave all the default settings?

If you use computer name to connect, you can keep default settings. In a small environment this shouldn't really be an issue. You can later change this if needed for any reason anyway.

 

[RoboX]

Thank you very much. Everything works perfectly.
Now, having resolved the issue of folder sharing and access, I would need to implement a backup system for data retention security.

What do you suggest I do?

I would have thought of a daily incremental backup on a second disk, and renew the full backup a couple of times a month:

- Do you think it is all right or do you recommend anything else?

- Also, could you advise me on some free software to do this?

 

[SenditMakine]

Thank you very much. Everything works perfectly.
Now, having resolved the issue of folder sharing and access, I would need to implement a backup system for data retention security.

What do you suggest I do?

I would have thought of a daily incremental backup on a second disk, and renew the full backup a couple of times a month:

- Do you think it is all right or do you recommend anything else?

- Also, could you advise me on some free software to do this?

Yeah, don't know about that, probably would want to research this too, you want a clone of your whole drive? Or you want to copy some predefined folders?

 

[RoboX]

only the folder I shared

 

[SenditMakine]

only the folder I shared

I don't know many programs that do this because it's fairly simple and most of the programs I know that can do it would charge for that (and I'm assuming that like me you wouldn't try piracy of software) so I'd suggest you just use a simple .bat for this and then put it on task scheduler once a day.
If you want I could write the code for you and you just input your disk paths there.
For what you want probably won't be more than 3 lines of code

 

[RoboX]

thank you very much for your availability....Unfortunately the PC owner does not like this solution (valid for me) but prefers to rely on software.
I read good reviews of Comodo Backup. What do you think, is it suitable?

 

[SenditMakine]

Never used, but doesn't sound bad, is just that I don't fell very confortable installing a third party software to do something I could do myself and know exactly what it is doing, I don't know what registry keys this software adds, I don't know what dlls he might install, if you're doing just a regularly copy and paste is just better to do it yourself, but since you're gonna use a software just make sure to let it automate things for you, so you don't have any more work afterwards.