Access Based Folder Enumeration

Discussion:

(too old to reply)

Andrew H

2005-08-17 09:35:56 UTC

Does SBS SP1 support the Access Based Enumeration folder add-on for Server
2003 SP1? What about the Server Management wizards - do they understand
Access Based Enumeration?

Steve Foster [SBS MVP]

2005-08-18 00:47:01 UTC

Permalink

Post by Andrew H
Does SBS SP1 support the Access Based Enumeration folder add-on for Server
2003 SP1? What about the Server Management wizards - do they understand
Access Based Enumeration?

It works fine. The wizards will only be affected if the person running
them does not have the relevant access to the appropriate shares (in which
case, the wizards would fail just as if the share were missing).

--
Steve Foster [SBS MVP]
---------------------------------------
MVPs do not work for Microsoft. Please reply only to the newsgroups.

Brandy Nee [MSFT]

2005-08-18 03:58:04 UTC

Permalink

Hello Andrew,

Thank you for posting to the SBS Newsgroup.

Thanks a lot for Steve's experience sharing!

I understand that you want to know whether Windows Server 2003 Access-based
Enumeration works compatible with SBS 2K3 server. If I have misunderstood
your concern, please let me know.

I have performed a test and installed it on my testing machine, it works
fine. This is a new tool working on Windows Server 2003 SP1.

This feature allows users of Windows Server 2003-based file servers to list
only the files and folders to which they have access when browsing content
on the file server. This eliminates user confusion that can be caused when
users connect to a file server and encounter a large number of files and
folders that they cannot access.

Windows Server 2003 Access-based Enumeration
http://www.microsoft.com/downloads/details.aspx?FamilyID=04a563d9-78d9-4342-
a485-b030ac442084&displaylang=en

Hope this information helps. If you need any assistance regard the SBS
server, please feel free to post back to this Newsgroup. I am glad to be
working with you again!

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Subject: Access Based Folder Enumeration
Date: Wed, 17 Aug 2005 11:35:56 +0200
Lines: 5
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
X-RFC2646: Format=Flowed; Original
Newsgroups: microsoft.public.windows.server.sbs
NNTP-Posting-Host: rrba-146-87-221.telkomadsl.co.za 165.146.87.221

TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP1
5.phx.gbl

Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:145157
X-Tomcat-NG: microsoft.public.windows.server.sbs
Does SBS SP1 support the Access Based Enumeration folder add-on for Server
2003 SP1? What about the Server Management wizards - do they understand
Access Based Enumeration?

Andrew H

2005-08-18 16:09:06 UTC

Permalink

I've installed the Access Based Enumeration (ABE) add-on to the server, and
I have two problems:

1. A user with no access to certain shares still can see them when
browsing the server from a workstation, even after turning on ABE on the
shares. As expected, he can't open the shares even though they are visible.
2. The SBS "Configure Shared Folders" wizard doesn't allow setting the
ABE options on existing or newly created shares. This isn't a big problem
since the option can still be set through Windows Explorer.

Post by Brandy Nee [MSFT]
Hello Andrew,
Thank you for posting to the SBS Newsgroup.
Thanks a lot for Steve's experience sharing!
I understand that you want to know whether Windows Server 2003

Access-based

Post by Brandy Nee [MSFT]
Enumeration works compatible with SBS 2K3 server. If I have misunderstood
your concern, please let me know.
I have performed a test and installed it on my testing machine, it works
fine. This is a new tool working on Windows Server 2003 SP1.
This feature allows users of Windows Server 2003-based file servers to list
only the files and folders to which they have access when browsing content
on the file server. This eliminates user confusion that can be caused when
users connect to a file server and encounter a large number of files and
folders that they cannot access.
Windows Server 2003 Access-based Enumeration

http://www.microsoft.com/downloads/details.aspx?FamilyID=04a563d9-78d9-4342-

Post by Brandy Nee [MSFT]
a485-b030ac442084&displaylang=en
Hope this information helps. If you need any assistance regard the SBS
server, please feel free to post back to this Newsgroup. I am glad to be
working with you again!
Best regards,
Brandy Nee
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------

TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP1

Post by Brandy Nee [MSFT]
5.phx.gbl

Brandy Nee [MSFT]

2005-08-19 08:19:36 UTC

Permalink

Hello Andrew,

Thank you for posting back!

Please see my information for each of your questions:

1. I need to know what exact these shared folders are. Please list all the
problematic shared Folders' name.

For your information: If the Shared Folders are: Address, ClientApps,
Clients, faxclient, <servername>.log, netlogon, roamingprofiles, sysvol,
tsclient, tsweb, and users, then this is an expected behavior.

This is because all these shared folders contain the user personal settings
which used for when they logging into the domain computer. You can notice
that after you input the domain account, there is a box saying computer is
applying personal settings. For example, Group Policy, which stored in
Shared Folder SYSVOL.

2. Please explain in detail ""Configure Shared Folders" wizard". On my test
machine, I went to Server Management\Standard Management\Shares (Local). On
the right pane, I ran the Share a Folder Wizard and the Change Shared
Folder Properties wizard, there was no Access-based Enumeration option
either. The Access-based Enumeration function only listed in the shared
Folder's Properties.

Hope this information answers your questions. If anything is unclear,
please feel free to let me know. I am looking forward to your reply.

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Subject: Re: Access Based Folder Enumeration
Date: Thu, 18 Aug 2005 18:09:06 +0200
Lines: 111
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1506
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506
Newsgroups: microsoft.public.windows.server.sbs
NNTP-Posting-Host: server.cjpetrow.co.za 196.37.0.10
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP15.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:145563
X-Tomcat-NG: microsoft.public.windows.server.sbs
I've installed the Access Based Enumeration (ABE) add-on to the server, and
1. A user with no access to certain shares still can see them when
browsing the server from a workstation, even after turning on ABE on the
shares. As expected, he can't open the shares even though they are visible.
2. The SBS "Configure Shared Folders" wizard doesn't allow setting the
ABE options on existing or newly created shares. This isn't a big problem
since the option can still be set through Windows Explorer.

Post by Brandy Nee [MSFT]
Hello Andrew,
Thank you for posting to the SBS Newsgroup.
Thanks a lot for Steve's experience sharing!
I understand that you want to know whether Windows Server 2003

Access-based

list

Post by Brandy Nee [MSFT]
only the files and folders to which they have access when browsing content
on the file server. This eliminates user confusion that can be caused when
users connect to a file server and encounter a large number of files and
folders that they cannot access.
Windows Server 2003 Access-based Enumeration

http://www.microsoft.com/downloads/details.aspx?FamilyID=04a563d9-78d9-4342

corresponding

Post by Brandy Nee [MSFT]
newsgroups so that they can be resolved in an efficient and timely manner.
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check

the

Post by Brandy Nee [MSFT]
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In

doing

Post by Brandy Nee [MSFT]
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no

rights.

Post by Brandy Nee [MSFT]
--------------------

TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP

Post by Brandy Nee [MSFT]
5.phx.gbl

Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:145157
X-Tomcat-NG: microsoft.public.windows.server.sbs
Does SBS SP1 support the Access Based Enumeration folder add-on for

Server

Post by Brandy Nee [MSFT]

2003 SP1? What about the Server Management wizards - do they understand
Access Based Enumeration?

Andrew H

2005-08-19 10:44:40 UTC

Permalink

Hi Brandy

Replies inline.

Regards

Andrew

Post by Brandy Nee [MSFT]
1. I need to know what exact these shared folders are. Please list all the
problematic shared Folders' name.
For your information: If the Shared Folders are: Address, ClientApps,
Clients, faxclient, <servername>.log, netlogon, roamingprofiles, sysvol,
tsclient, tsweb, and users, then this is an expected behavior.
This is because all these shared folders contain the user personal settings
which used for when they logging into the domain computer. You can notice
that after you input the domain account, there is a box saying computer is
applying personal settings. For example, Group Policy, which stored in
Shared Folder SYSVOL.

Perhaps I'm confused here. I was under the impression that if a user had no
permissions on a share, he wouldn't be able to see the share when browsing
the server. With some experimentation, it looks like the user will see the
share regardless of his permissions, even if he can't open the share. If he
has permission to view the share, then ABE seems to hide the file and folder
objects *within* the share to which the user has been denied access based on
the Security property of the object.

I was hoping that the share itself would be invisible. For example, if a
share was called TOPSECRET and only specific users had permission to work
with it, I was hoping that all other users would not be even aware of the
existance of the TOPSECRET share. (I know that TOPSECRET$ would be
invisible to all browsers, but ABE seemed to offer selective visibility.)

Post by Brandy Nee [MSFT]
2. Please explain in detail ""Configure Shared Folders" wizard". On my test
machine, I went to Server Management\Standard Management\Shares (Local). On
the right pane, I ran the Share a Folder Wizard and the Change Shared
Folder Properties wizard, there was no Access-based Enumeration option
either. The Access-based Enumeration function only listed in the shared
Folder's Properties.

This was my experience too - the wizards aren't aware of the ABE option, ABE
has to be managed from Explorer.

Brandy Nee [MSFT]

2005-08-22 10:24:59 UTC

Permalink

Hello Andrew,

Thank you for posting back!

I understand that you want to make the shared folder TOPSECRET invisible
for users who do not have permissions. I assume that TOPSECRET is the top
level shared folder. ABE only works and can hide the subfolders/files
within top level share folder if user does not have permissions.

Hope this information answers your question. If anything is unclear, please
feel free to let me know. I am glad to be of assistance!

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Subject: Re: Access Based Folder Enumeration
Date: Fri, 19 Aug 2005 12:44:40 +0200
Lines: 53
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
X-RFC2646: Format=Flowed; Original
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
Newsgroups: microsoft.public.windows.server.sbs
NNTP-Posting-Host: rrba-146-87-221.telkomadsl.co.za 165.146.87.221
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:145863
X-Tomcat-NG: microsoft.public.windows.server.sbs
Hi Brandy
Replies inline.
Regards
Andrew

Perhaps I'm confused here. I was under the impression that if a user had no
permissions on a share, he wouldn't be able to see the share when browsing
the server. With some experimentation, it looks like the user will see the
share regardless of his permissions, even if he can't open the share. If he
has permission to view the share, then ABE seems to hide the file and folder
objects *within* the share to which the user has been denied access based on
the Security property of the object.
I was hoping that the share itself would be invisible. For example, if a
share was called TOPSECRET and only specific users had permission to work
with it, I was hoping that all other users would not be even aware of the
existance of the TOPSECRET share. (I know that TOPSECRET$ would be
invisible to all browsers, but ABE seemed to offer selective visibility.)

This was my experience too - the wizards aren't aware of the ABE option, ABE
has to be managed from Explorer.

Brandy Nee [MSFT]

2005-08-19 08:36:56 UTC

Permalink

Hello Andrew,

I found some additional information, please see the following document:

Windows Server 2003 Access-based Enumeration
http://download.microsoft.com/download/4/9/8/498EEEEF-97B0-450E-8E56-26105D4
B092E/Accessbasedenum.doc#_Toc101345516

Hope this information helps. If you have any questions or concerns on this
issue, please feel free to let me know. I am looking forward to your reply.

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Post by Brandy Nee [MSFT]
Hello Andrew,
Thank you for posting to the SBS Newsgroup.
Thanks a lot for Steve's experience sharing!
I understand that you want to know whether Windows Server 2003

Access-based

list

http://www.microsoft.com/downloads/details.aspx?FamilyID=04a563d9-78d9-4342

corresponding

the

doing

rights.

Post by Brandy Nee [MSFT]
--------------------

TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP

Post by Brandy Nee [MSFT]
5.phx.gbl

Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:145157
X-Tomcat-NG: microsoft.public.windows.server.sbs
Does SBS SP1 support the Access Based Enumeration folder add-on for

Server

Post by Brandy Nee [MSFT]

2003 SP1? What about the Server Management wizards - do they understand
Access Based Enumeration?