Creating a network share for folder, children, files from laptop to desktop

[GracieAllen]

I asked this in a different forum, but didn't get any useful answers, so I'll try here...

Window 10 desktop. Perfectly normal, PC, Windows 10 64-bit.... Operated and administered by me.
Windows 10 laptop. Also perfectly normal, boring laptop. Operated and administered by me. The accounts on BOTH boxes are EXACTLY the same so there IS an account on each machine.

On desktop box I have a disk partition. In which there's a folder "A"... Inside A are a bunch of other folders, and inside those are a bunch of files.... PLAIN, ORDINARY FOLDERS WITH PLAIN ORDINARY FILES.

From the laptop, I want to log in and be able to see, view, edit, delete and do normal, ordinary things to desktop folder "A", any of it's children and any of the FILES in any of the children...

I'm not sure I understand what the limits of having "Everyone" do those things. I'm concerned it opens up the folders and files to access from anyone, anywhere. Can someone provide information on exactly what the ramifications of having "Everyone" able to do anything are compared to specifically creating a share for only me?

After an incredible amount of messing around, that got me from no access, to read-only access, and BACK to no access, I've currently got the folder set up to "EVERYONE" can do things. BUT, presuming this isn't a good idea, I'd LIKE to have it just allow ME to get at the files.

Unfortunately, when I set "Everyone" to read access and add myself as a user with FULL access, I can only READ any file in a folder under "A". No matter what I set for permissions, I can only read.

SO, HOW do I create the share, put MY account in as the ONLY user, and get FULL access - read, write, change, delete, whatever to the folders and files in "A"?

BTW: The last time I put permissions in for me, then went into the Security tab and set things as specified by at LEAST one of the umpteen things I've read about how to do this, I got NO ACCESS... Literally, windows on the laptop threw a hissy fit, displaying a popup that I had no access.

So, HOW do what I'd like, if I need to? OR, is having "Everyone" in there OK?

 

[Trouble]

So on the Desktop, right click folder A and choose properties.
In that folder's properties dialog box you will see a number of tabs across the top.
The two you are concerned with are "Sharing" and "Security"
Select the "Sharing" tab and the advanced sharing button, check the Share this folder box give it a name if needed it generally defaults to the original name.
Now click the "Permissions" button and "Everyone" should already be there, do add anyone (IF you have remove them leaving only "Everyone")
Check the box under the "Allow" column next to Full Control thereby granting everyone who access this file across the network "Full Control".
OK your way out of there.
NOW
To set granular security select the "Security" tab and click the advanced button.
Now click the "Disable inheritance" button and when prompted simply click Convert inherited blah blah
Now check the box that says "Replace all child object permission entries blah blah" and then click the add button.
You have said that

The accounts on BOTH boxes are EXACTLY the same so there IS an account on each machine.

Which is kinda handy as Windows "Pass through" authentication will handle the heavy lifting.
Click the link that says "Select a principal"
Click "Advanced" button and then the "Find Now" button
Select that account from the list and click OK and then OK again
NOW
Check the box at the top that says "Full Control"
And click OK again and then OK again
Click Yes when prompted and then Close
That's it.
You should be able to access and do what you want to that folder and child objects from the laptop.

WHAT you have done is, for some, difficult to understand but....
When accessing files across a network, both Share Permissions as well as NTFS (security) permissions are involved and when both are applied, the most restrictive wins.
IT can be a bit complicated and can be complicated by various group memberships.
IF you want to understand it a little bit better
http://www.techexams.net/technotes/70290/permissions.shtml

BASICALLY IF.....
You would log onto the laptop as a user other than the user you chose above, that user would be denied access based on your NTFS (Security Tab) permission settings.
Unless that user was also present on the desktop, with the appropriate permission to support access.

 

[GracieAllen]

OK, I've got the first part done right - at least it's working so...

"NOW
To set granular security select the "Security" tab and click the advanced button."

Did that.

"Now click the "Disable inheritance" button and when prompted simply click Convert inherited blah blah
Now check the box that says "Replace all child object permission entries blah blah" and then click the add button."

On my Security Advanced screen I don't have a "Disable inheritance" button. Mine says "Enable inheritance" so I presume I'm already disabled. I don't see anything for "Convert inherited" and I'd rather not "Enable Inheritance" to see what'll happen... Current the "Replace all child object..." ISN'T checked. Do I NEED to Enable this, then convert... and check the "Replace"? Or since it's not enabled, can I ignore it?

"Click the link that says "Select a principal""

Presuming I'm still on the Security Advanced screen, I don't HAVE any link that says select a Principal. Currently, there are multiple entries in the Permission.
Type Principal Access
Allow Me Full control
Allow Everyone Full control
Allow Administrators Full control
Allow System Full control

If I select any of those users(?), and click "Edit", I get a screen with a bunch of options like Full control, Modify, Read & Execute, list folder, Read Write...

All of them are selected except "Special permissions" for ALL the entries in the list...

Click "Advanced" button and then the "Find Now" button
Select that account from the list and click OK and then OK again
NOW
Check the box at the top that says "Full Control"
And click OK again and then OK again
Click Yes when prompted and then Close
That's it.
You should be able to access and do what you want to that folder and child objects from the laptop."

Since I already have all the users (I think all of 'em) in the list in the Security popup, do I get RID of some? Since I already HAVE Full Control and all the other boxes checked for everybody in the list, SHOULD they be? Should Administrators and System have all the boxes checked?

Should my account?
And what should I set the "Everyone" to? Read? Full Control? Nothing?

I read through the information at the link you provided, and sort-of understand. BUT, I didn't see any examples of what the security should be set to for "Everyone"...

There's a "Share" tab next to the Permissions tab on the Security screen. Does it have anything to do with anything? 'Cause the only thing in there is Administrators with Full Control and Everyone with Full Control...
If I DO need to change Everyone to something else on the Permissions screen, will it change this thing?

 

[Trouble]

I read through the information at the link you provided, and sort-of understand. BUT, I didn't see any examples of what the security should be set to for "Everyone"...

Typically..... "Everyone" is not added or present within or under the "Security" tab.
That is where you set specific granular permissions and using the "Everyone" group more or less defeats and complicates the process because as the name implies everyone belongs to the "Everyone" security group and that's when you run into issues with conflicting group membership.
The Security Tab is intended to set granular "explicit" permissions to lock down control of a particular share.

 

[GracieAllen]

Cool... OK, I'm going in an getting rid of Everyone. We'll see how it goes. HOPEFULLY, better than last time I messed with things and wound up with NO access... I never did figure out what I'd done wrong.

Update: Well, that didn't take long. I made ONE change. On the Security tab for the folder, I removed "Everyone". My account still has every box checked. As does SYSTEM. Rebooted both boxes, checked to make sure the Security was exactly the way it was (no "Everyone"), tried to connect the laptop and got the popup that says "You do not have permission to access xxx."

Sharing is still exactly the way it was, with "Administrators" (of which I am one) and "Everyone" having full control.

?

 

[GracieAllen]

I put Everyone BACK in Security and gave it read, and now I have READ access to the folder...

WHY only with Everyone in there?

 

[Trouble]

Sounds to me like perhaps the two accounts are not as identical as you thought.
Are you certain, that you are using the exact same UserName and Password on both computers.
IF so, then.....
It is likely a conflict in group membership.
As I explained earlier if your User Account has cross group membership you can end up with something like you are experiencing.
"Everyone" Security Group has full access
BUT
"Users" or "Authenticated Users" has "Read" and nothing higher.....
The "Read" wins and your account, being a member of both groups only has "Read"

I usually remove my user account from all other Security Groups except "Administrators" Group.

ALSO, please note that when you alter permission on the Desktop to a "share" that it is hosting.
THEN
The user on the laptop will need to log off and log back on to receive an updated access token.

 

[GracieAllen]

Sounds to me like perhaps the two accounts are not as identical as you thought.
Are you certain, that you are using the exact same UserName and Password on both computers.

I wondered the same thing a little while ago and checked on both computers. I KNOW the passwords are the same, but I wanted to make sure the username was exact, right down to the case of the letters. Unless there is something I can't see, they're exactly the same.

IF so, then.....
It is likely a conflict in group membership.
As I explained earlier if your User Account has cross group membership you can end up with something like you are experiencing.
"Everyone" Security Group has full access
BUT
"Users" or "Authenticated Users" has "Read" and nothing higher.....
The "Read" wins and your account, being a member of both groups only has "Read"

I usually remove my user account from all other Security Groups except "Administrators" Group.

Is there somewhere OTHER than the Security tab on the folder that I'd find the "group membership" stuff? I don't know what groups my account is part of, so I'd need to go in and check... I'll rummage while I'm waiting and see if I can find wherever the "group membership" stuff is...

ALSO, Since I"m letting Everyone have full control on the Advanced Sharing permissions, should I have MY account in there? It doesn't appear to be making any difference - at least not in a positive way, but I'm curious.

ALSO, please note that when you alter permission on the Desktop to a "share" that it is hosting.
THEN
The user on the laptop will need to log off and log back on to receive an updated access token.

I wasn't sure about this, but I've been rebooting the laptop each time I make a change on the desktop...

 

[Trouble]

IF these computers are running Windows 10 Pro or higher
You can use
lusrmgr.msc from the run command
to see

IF you are running Windows 10 Home then it's a bit less user friendly.
From a command prompt you can type
net user UserName (where UserName is the name of the User you wish to see their group membership)

 

[GracieAllen]

The desktop box is running Windows 10 Pro, so I ran lusrmgr.msc and went into the screen. I looked at each group, to see who was a member of what. My account is in Administrators, as is Administrator.

I also looked at each user (of which there's just me, default, and guest and administrator. My account said I was a member of Administrators and Users. So, I removed me from users.

My account isn't in any other groups, and no other groups show me as a member.

Here's what I've got at this point...
Properties/Advanced Sharing:
Everyone Full Control
Administrators Full Control

Security
Everyone (currently set to read & execute, hope to REMOVE Everyone once this is working)
System Full Control
Me Full Control

My account isn't a member of any group except Administrators......

I just verified all this...

Rebooted the laptop. Connected to the share. With the current settings in security I ONLY have READ access.

I REMOVED Everyone from Security. Rebooted laptop. Went back in. I now have NO access. It pops up the error with "you do not have permission to access...

Even though I am, to whatever degree possible, absolutely positive that both the username and password are identical on the two machines, is there ANY way to have the laptop log in using a specific account on the desktop? 'Cause this isn't working without giving Everyone full control...

I just went to ANOTHER laptop, my wife's. That has HER account on it. I CREATED a new administrator account on the desktop box, using her username and password. I ADDED that account to the security tab of Properties for the top level folder I'm sharing, and gave her Full Control...

Rebooted her laptop after all that was done, then connected to the share. She ALSO has NO permission.

I then put Everyone BACK in the security tab and gave it full control. Did the same thing again. My laptop has full access. My wife's laptop has full access. I'm having a really hard time believing I got BOTH accounts wrong, so what else can it be?

 

[Trouble]

Start fresh.
Create a new folder on the desktop in the root of C:\
Call it TestShare
Setup sharing as I describe above, don't change anything that is already present, just add yours and your wife's account explicitly to the security tab (NTFS permissions) and be sure to grant full control to the Everyone group under the share permissions.
Disable inheritance if it is inheriting and cascade your security settings to child objects.
Test to see if you can see it and open it.
Drop a couple images into it or music files or whatever and see if you can interact with them.

You mentioned that the desktop is using Pro, but you didn't say anything about the two laptops.
I do remember reading something at some point that the Home version has some issue with complicated sharing unless the Guest account is enabled.
Personally, I wouldn't consider enabling the Guest account anywhere on my network and unfortunately I don't have the Home Version of Windows 10 installed on anything so I can't duplicate your environment to test.

You might be stuck with full control to everyone in both places or upgrading to Pro, although I'm certain that I've used Windows 7 Home version on a network to access files on a Windows Server, just making sure that the account (user name and password) were present and identical on the server and that, that account had the appropriate permissions to access the share.

I may have to install Windows 10 Home version just to play around with this issue.

 

[GracieAllen]

OK, this time it worked... I did EXACTLY the same the a couple days ago, but this time I think I got it. There was ONE difference between then and now.

This time, when I created the share, there was only ONE user in there - "Everyone". On the one I created a couple days ago, there were TWO users "Everyone" and "Administrators"...

So, when the new one worked fine, I want back to the other folder "A" and REMOVED "Administrators" from the share, leaving ONLY "Everyone" with Full Control... That one now works fine too........

I have NO idea why having Administrators in there should make any difference, but NOT having it, and having the "normal" accounts in the Security tab, WITHOUT "Everyone" (it's just Administrators, SYSTEM, and our two user accounts) has things working fine. Not sure why, but it APPEARS to be working fine.

BTW: I created a NEW folder on another drive , and created a share. On THAT new folder, I GOT NO USERS in the Permissions. I had to ADD "Everyone"... Bizarre, but as long as it works, I don't care.

Thanks for sticking with me and getting this to work. In the long run it'll make my life a lot easier since the domestic associate won't have to be in the man cave bothering me!

 

[Trouble]

Glad to hear you managed to sort things out.