• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Limiting Server Access

U

USMCGrunt

2[H]4U
Joined
Mar 19, 2010
Messages
3,103
So, I want to be able to limit a person's visibility of our servers at work. Currently, anybody that connects to the WiFi can figure out our server names and then pull them up by hitting \\servername, I'd like to limit who has permission to do that to specific groups, is that possible? At the moment, I've got it locked down so that while they can see and connect to the printers hosted on a given server, they can't see or access any shares hosted on that server. If I could, I'd like to limit it so that when they type \\servername, they're met with an access denied or at least a credentials window.
 
Put a $ on the end of a share, and it won't show up when the browse to it. It works for printers, too...
 
Demon10000 said:
Put a $ on the end of a share, and it won't show up when the browse to it. It works for printers, too...
Click to expand...

I've got that done but it still shows attached printers and sysvol/netlogon folders. What I'd like is to limit people from even being able to see anything when they hit \\servername, like a request for credentials window or a flat out access denied.
 
Are these guests accessing the wifi or employees? If guests, they should be on a segregated network.
 
remove "Domain Users" from the "Users" group of the servers, and replace with appropriate Domain groups.
 
Why are your servers on the same network as a wifi network....

servers should be separate or segmented via vlans or physically seperate so the only access is to the resources they host via specific ACL's.

Question is, why do you not want people to see these drives? sysvol and such is used for domains and such, and is meant to be seen...
 
Because this is a non-profit that demands wifi be open to the public and has a 7 million dollar operating budget that's trying to cut its IT spending that topped a whopping 100k last year....
 
MrGuvernment said:
Why are your servers on the same network as a wifi network....

servers should be separate or segmented via vlans or physically seperate so the only access is to the resources they host via specific ACL's.

Question is, why do you not want people to see these drives? sysvol and such is used for domains and such, and is meant to be seen...
Click to expand...

^^ What he said.

I worked for a not-for-profit that had the same requirement...
I recommended a cheap connection directly out to the i-net via consumer
grade equipment for complete isolation from the internal network.

I didn't want _any_ of the public WiFi users to touch production equipment
or their traffic having to be processed by our routers/switches.

I got laughed at by the network team ... but I'd still go that route today depending on coverage area.

They ended up using a specific VLAN for public traffic that got routed directly out.
 
Netwerkz101 said:
^^ What he said.

I worked for a not-for-profit that had the same requirement...
I recommended a cheap connection directly out to the i-net via consumer
grade equipment for complete isolation from the internal network.

I didn't want _any_ of the public WiFi users to touch production equipment
or their traffic having to be processed by our routers/switches.

I got laughed at by the network team ... but I'd still go that route today depending on coverage area.

They ended up using a specific VLAN for public traffic that got routed directly out.
Click to expand...

Yup, $300 dollars for three cheap WAPs that would run on a separate VLAN out a spare static IP at the ISP modem....and they declined...would rather spend it on....another department. E-mail even got blacklisted because a public wifi user had a virus that was spamming mail out, was that enough to get them to commit? Nope.
 
Assuming guests need no domain access, again just separate out access via the WAP controls.
 
You must log in or register to reply here.
Back
Top