Category: Home Networking

For system administration purposes, both Windows XP and Windows 2000 Professional systems share the root of each drive. By default, this “folder” is shared using a name created by taking the drive letter (such as C) and appending a dollar sign ($) to the end of it. On a Windows XP/2000 Professional system, these administratively shared folders are only accessible to administrators.

The $ symbol following the drive letter hides the share, ensuring that it is not displayed in My Network Places, Network Neighborhood, or when the NET VIEW command is issued. In order to access hidden shares, an administrator would typically map a network drive or enter the path at the Run command – for example, \\192.168.1.100\C$. To that end, for a higher degree of privacy, consider hiding all shared folders on your network by appending the $ symbol to the end of their share name – such folders will still be accessible over the network, but only to users who know and can provide the correct path.

On Windows XP Home systems, the root of each drive is not shared automatically, but can be by accessing the properties of the drive if required. As a general rule, avoid sharing drives from the root, since the careless assignment of permission potentially exposes the contents of the entire drive to anyone who can connect to it. This can lead to the malicious or accidentally deletion of critical system or data files, something you’ll want to avoid at all costs.

If you’re running Windows XP Home (or Professional as part of a workgroup), Microsoft has introduced a new feature known as Simple File Sharing. This feature is meant to make the process of sharing files with other users both on the network and the same PC more intuitive. Unfortunately, this method strays from the standard method of assigning permissions that you are probably familiar with from previous OS versions, and can be confusing. While Windows XP Professional users have the option of turning Simple File Sharing off (as shown at right), no such option exists for Windows XP Home users. A simple (is annoying) workaround does exist for XP Home users, however, as outlined in another article that follows.

While Simple File Sharing makes sharing resources a little easier for users, it also hides what is going on behind the scenes in terms of the actual permissions assigned to a particular resource. Simple File Sharing consists of 5 security “levels”, each of which handles how folders are shared and secured differently. Making the entire situation even more cryptic, the methods used to obtain each level of security involves slightly different procedures, but each is outlined below.

Level 1 – configured by checking the Make this folder private checkbox on the Sharing tab of a user’s My Documents folder, this setting grants both the owner and system the Full Control permission, and the folder is not shared.

Level 2 – the default setting on a user’s My Documents folder grants the owner, system, and Administrators group Full Control, and the folder is not shared.

Level 3 – configured by moving or copying a file or folder to a user’s Shared Documents folder, this grants the owner, system, and Administrators group full control, and all other users the Read permission. On a Windows XP Professional system, the Power Users group is granted the Modify permission. This level allows local sharing only, with documents not shared with network users.

Level 4 – configured by accessing the Sharing tab for a folder and checking the Share this folder on the network checkbox. Grants the owner, system, and Administrators group Full Control locally, the Everyone group Read permission locally, and the Everyone group the Read shared folder permission.

Level 5 – configured by accessing the Sharing tab for a folder and checking both the Share this folder on the network and Allow network users to change my files checkboxes. Grants the owner, system, and Administrators group Full Control locally, the Everyone group Change permission locally, and the Everyone group the Full Control shared folder permission.

The primary purpose for implementing a network is to allow users to share resources. For example, users on one PC might want to access the contents of a folder or use a printer on another system. Although sharing a folder or printer on a system running any Windows version from 95 forward is a relatively simple proposition, ensuring that the resource is properly secured in a more critical consideration. In a nutshell, the default permissions assigned to shared resources on a Windows system are inherently insecure, and should almost always be changed.

Futhermore, it’s important to keep in mind that shared folder permissions only apply to users connecting to that resource over the network – these permissions do not apply to local users.
Sharing a folder on a Windows system provides a great example of what we mean here. If you were to share a folder named Files on a Windows 98 system, the default permission that is applied to the folder is “Read-Only” to a group known as “The World”. As this group name suggests, this permission will allow any and all users to access the shared folder will Read-Only access. This may not seem like a terrible situation, since Read-Only access would not allow connecting users to make changes to your files. However, it will allow them to open and read files, as well as copy those files to different locations, where they can ultimately do with them what they please. Because the possible shared folder permissions that can be configured on a Windows 98 are limited, storing resources in a shared folder on a Windows 2000 or XP system is generally your best option, as you’ll learn shortly. Barring that, however, be sure to configure passwords for shared folders on Windows 9X/ME systems if the folder contains any data that you consider to be critical or private in nature.

If you’re sharing a folder from a Windows 2000 or Windows XP Professional system (with Simple File Sharing disabled), then you’ll also need to carefully consider the permissions you assign. When a folder is shared from a Windows 2000 system, the default permission grant a group known as “Everyone” full control over the contents of the folder. This permission would ultimately allow any user to do as they pleased with the contents of the folder. The default permission for a new shared folder in Windows XP Professional is a little more secure, granting the Everyone group Read access only, though this makes the folder subject to the same issues looked at in the Windows 98 section. For a higher degree of security, consider removing the Everyone group when configuring shared folder permissions on these operating systems, and grant permissions to an authenticated group (like Users) instead.

It may not seem necessary, but another area that you should also consider is the security of your printers. On a Windows XP or Windows 2000 Professional system, the properties of a printer includes a Security tab, which by default allows the Everyone group the ability to Print documents. Unfortunately, this setting allows anyone to print to the printer. For a higher degree of security, you can use the Security tab to control which printers a user is allowed to print to, or whether they have the ability to change printer settings. This can be useful when you want to avoid having certain users misuse an expensive colour printer, for example.

While good internal security starts with user accounts, more important still is the strength of the passwords assigned to those accounts. Far too many users take the easy way out on this one, assigning very common or “guessable” words as their password. In the same way that it’s a bad idea to set your PIN number on your bankcard to 1111 or the combination of your month/year of birth, the same holds true for the password assigned to user accounts. Quite simply, too many utilities exist that can easily guess passwords based on common words, using what it known as a dictionary attack. If you’re serious about security, then be serious about your password – your last name, dog’s name, or “password” just won’t cut it.

Good password security exhibits two main features. The first is that the password should be hard to guess, including a combination of upper- and lower-case characters, numbers, and special characters (such as %@$^~ as examples). The second critical consideration with passwords is how often they are changed. As a general rule, get users on your network in the habit of changing their passwords at least once every 30-60 days, and be sure to assign a password to all user accounts. On a Windows XP or Windows 2000 Professional system, password changes can be made mandatory by configuring Password Policy settings in the Local Security Policy Administrative Tool.

Securing your internal network always starts with the same concept, namely authentication. In the same way that you need a unique card to access your bank account, all users of a network should have their own unique username for identification purposes. While have all users access a network using the same username is obviously simpler, it is also inherently insecure, and doesn’t allow you to take advantage of the benefits that security measure like permissions provide.

When users log on to a PC using a unique username, they are allocated a dedicated folder structure on the disk that stores their individual files, folders, and settings, which is obviously beneficial in a shared environment. On a Windows XP or 2000 system, this folder structure (which includes folders like My Documents) can be further secured to ensure privacy, and we’ll explore shortly.

More importantly, when users are assigned individual usernames, those users can be assigned unique permissions to network resources such as shared and local folders on a Windows XP or 2000 system. User accounts are created using the User Accounts applet in Control Panel, as shown below. The steps for creating user accounts on a Windows XP Home system is relatively straightforward, and involves following the steps of a very basic wizard-type interface. On a Windows XP or Windows 2000 Professional system, use the Local Users and Group tools available in the Computer Management administrative tool. Both Windows XP and 2000 systems include a built-in Guest account. This account is disabled by default, and should be left as such for security purposes. If you need to grant a new user access to your network, taking the 2 minutes to create a dedicated user account for them is always a better solution.

When it comes to securing a home network, most users fall into the trap of believe that a simple home firewall device will provide all the security they need. While some type of firewall device or firewall software package is imperative for any network, this is where properly securing a network begins, not where it ends. Regardless of whether your network is of the wired or wireless variety, you’ll want to take a good hard look at many of the other recommendations listed in this column to ensure that your network is properly secured.

When thinking about network security, one of the best analogies you can use is one that we’re all familiar with – securing your home. In the same way that you lock your door at night to keep the outside world at bay, firewall hardware and software is designed to keep the general public out of your network – in this case other Internet users.

While locking that door is critical, you probably go a little further when it comes to securing your belongings within your house. For example, it’s probably a safe bet to assume that you don’t leave big stacks of money sitting on the kitchen table, or jewelry boxes sitting open in windows. More likely, you take the extra step to make sure that these items are hidden and secured to at least some degree. In the same way that you secure those valuables already behind a locked door, you also need to seriously consider securing resources on your internal network.