Some of the main topics in this chapter are
There are certain things you expect a network operating system (NOS) to do well. One of them is sharing files and another is sharing printers. Those two tasks are among the fundamental reasons why a NOS exists.
Windows NT Server, being a NOS, is well equipped to share files and printers. In fact, with the graphical interface and tools supplied, it's arguably one of the easiest NOSs to administer. Like many other functions in Windows NT Server, there isn't just one way to share files and printers.
In this chapter, you'll learn about the different ways to share files and printers in Windows NT Server. You'll see the strengths and weaknesses of each method so you'll understand when it's appropriate to use a certain method.
You'll also learn about security in both file and print sharing. A NOS should not only make files and printers available on the network, it should do so only to the people you authorize. You'll learn how you can have a greater level of comfort about what your users have access to on the network.
Before you can share files on a Windows NT network, there are a couple of items you need to make sure are correctly set up. Make sure that browsing is working correctly on your network and that the Server service is started on your Windows NT Server system or any Windows NT system that's going to share files.
Browsing in Windows NT networking describes how you find other computers on your network. When you double-click the Network Neighborhood icon on your desktop, the browser feature of your network shows you all the systems on your network.
When a client computer requests access to a file on Windows NT Server, the software that receives the request and works to fulfill it is called the Server service. The Server service gets requests from the network for files. The Server service then interacts with the file system to read or write the appropriate file and then respond to the client that made the request. So having the Server service running is essential to having network access to files on Windows NT Server.
You'll normally find the Server service running on Windows NT Server by default. However, there are cases where the service does not start (or fails), and you need to start it manually. There are a couple of ways to start the Server service.
If you're sitting in front of the Windows NT Server system, the easiest route to check or start the Server service is through Control Panel. In Control Panel, double-click the Services icon. Listed in the Services dialog box is the Server service.
Figure 23.1 shows the Server service started and set up to start automatically with Windows NT Server. If the Server service weren't running, the Status column would be blank like the Schedule service item above the Server service item in this figure. To start the Server service, click to select it and then click Start. If the service isn't set up to start automatically, click Startup and then change the Startup Type to Automatic.
Normally, the Server service is always active on a Windows NT Server system. If you're having problems accessing files on this system, however, check to see if this service is started.
If you're having problems starting the Server service, check the event log. It might let you know what the underlying problem is, so you can fix the problem that's preventing you from starting the Server service. For more information about the event log, see Chapter 18, "Administering the Server."
Another way to control the Server service is through the DOS NET command. Using NET START and NET STOP, you can control all services, including the Server service. Figure 23.2 shows the NET START command being used to start the Server service.
After you have the capability to see the computers in your network, you're ready to start sharing data. In Windows NT, you can share folders (or directories) and devices.
Windows NT doesn't support sharing down to the file level. If you want to provide or restrict access to individual files, you need to use security to do that. Although this chapter is called "Sharing Files and Printers," a folder is what you share, not a file.
The devices that Windows NT can share include printers, CD-ROM drives, and hard drives. You'll learn how to share CD-ROM drives and hard drives in the section later in
this chapter titled, "Using the Explorer to Create Shares." You'll learn how to share printers in the section titled, "Sharing Printers in Windows NT Server."
The DOS NET command provides another way to start and stop services. You can use the NET START command by itself to see what services are active.
One of the requirements of sharing resources is that you need to assign a name to the resource. This name is called the share name. There are a number of rules and suggestions to follow when choosing the share name.
The size limit for a share name is 80 characters. You can use spaces and many of the special characters such as the pound sign (#), at sign (@), and exclamation point (!). That's what you can get away with. However, bear in mind that clients other than Windows NT might not be able to use names that go to that extreme.
For DOS clients, you normally want to stick to eight characters or less, use only numeric and alphabetic characters, and avoid spaces. There are additional considerations for other clients, but I suggest that you keep the name simple if you aren't using Windows on all of your client systems.
Some extremists might argue that sticking to the DOS limitation hurts the people who are using Windows 95 and Windows NT on the desktop. Having to use a short, and often non-descriptive, name in operating systems that support long file names seems to make the task of finding what you need more difficult than necessary. However, you can add a comment for each share that users will be able to see when they're selecting which share they want to use. So keep the share names simple, and everyone will be able to access them easily and equally.
The dollar sign ($) is a special character used in the share naming convention. If you put the dollar sign at the end of a share name (for example, MyShare$) users won't be able to see it when they're browsing. You can still attach to the share from a DOS prompt if you know what the name is and have the proper authority.
If you use this dollar sign trick, you create a hidden share. Hidden shares are used by Windows NT to support network logon and make administration easier.
There are a number of hidden shares created when Windows NT Server starts. For example, on my system right now I have the following hidden shares available:
I didn't create those hidden shares, and if I delete them, they'll be re-created the next time I start Windows NT. You can access these shares if you use the DOS NET SHARE command, which you'll see in greater detail in the "Using DOS Commands to Create a Share" section later in this chapter.
It's easy to jump to the conclusion that this represents a serious security issue. Only a profile with Administrator authority can access these specific hidden shares, however, and if you're giving everyone Administrator authority, you've probably got bigger problems than share authority.
NOTE: For more information on resource sharing security, see Chapter 26, "Securing NT Server."
There are a number of different ways to create directory shares on Windows NT. Here are the methods covered in this chapter:
You'll begin with the easiest method and follow through to the more complex. However, there are reasons to use each method, depending on the situation you're in. Using the File and Folder Access Wizard is probably the fastest method. You can use the DOS NET commands in a batch file--for example, as part of a logon script.
The Administrative Wizards are a recent addition to Windows NT, provided for the purpose of easing common administration tasks. There are Administrative Wizards to create user accounts, to add a printer, and to manage file and folder access. The wizard that enables you to manage file and folder access handles not only permissions but also whether only the folders are shared on the network.
Starting the File and Folder Access Wizard. Ignore the permission management capabilities of the File and Folder Access Wizard for the sake of discussing using the wizard to share directories. To start the Administrative Wizards tool, choose Start, Programs, Administrative Tools, and select Administrative Wizards (see Figure 23.3).
This is probably the easiest way to share directories on your network. If you're going to use this tool frequently, consider creating a shortcut on your desktop.
After you start the Administrative Wizards tool, you see the screen shown in Figure 23.4. Highlight and then click the Managing File and Folder Access item to start the tool.
This window was added to Windows NT 4.0 to help make administration tasks easier. Moving your cursor over an option highlights it and clicking it when highlighted starts the selected tool.
Sharing Directories Using the Wizard. After you
start the File and Folder Access Wizard, you first must select whether you're going
to work with directories on the local system or on a remote system (see Figure 23.5).
For this example, select the On My Computer option, and then click Next.
If you select a remote system, a dialog box is displayed, enabling you to enter the name of the remote system or select one from the list.
Next, you select the directory you want to share on the network (see Figure 23.6). For this example, I've selected a directory on drive C: named Runner. After you've selected the directory, click Next.
This is where you select the directory to share. You can also select to give access to a drive.
The next window in the wizard (see Figure 23.7) enables you to maintain the permissions for the folder you've selected. This is unavailable on a FAT or CDFS volume. Your focus is on sharing the folder, not maintaining permissions, so click Next.
Because right now you care about sharing, not permissions, leave the Keep the Original Permissions option selected, and click Next.
A dialog box asks whether you want to share this folder with network users. Click Yes. The next window (see Figure 23.8) enables you to create a share for the folder selected. Enter a description for the share (such as the one I've done for this example) and click Next. From this window, you also can change the name of the share, as well as what other services, such as NetWare and Macintosh, have access to the share.
This is the window used to name the share, add a description, and select which services have access to the share.
The last window in the process, as shown in Figure 23.9, confirms the selections that have been made. By clicking the Back button, you can traverse back through the windows and change the share name and description. If you don't want to create this share, click Cancel. If you're satisfied and want the share created, click Finish.
This is the window that confirms the choices made in creating the share. You can go back through the previous windows to change anything with which you're dissatisfied.
That's all there is to using the Administrative Wizards feature to create a share--it's about the easiest way possible. Using the Explorer, as you'll see next, is almost as easy.
Using the Explorer to Create Shares. In this example, you'll learn how to share a CD-ROM drive. In Explorer, highlight the CD-ROM drive, which in this case is drive E:. Right-click the drive to access a context menu (see Figure 23.10), and click Properties.
You see the Properties dialog box for that specific drive, as shown in Figure 23.11. Click the Sharing tab so you can name the share, restrict the number of users that can access
the share, and set permissions for the share. In this case, I've named the share CDROM and added a comment. Share permissions are covered in the next section.
You also could click the Properties button on the toolbar or choose File, Properties.
This dialog box enables you to create a share for a folder or device.
After you've filled in all the entries, click OK to create the share. The icon for the drive changes and a hand holding the device appears to let you know the drive is shared. After you create a share, the Add an Additional Share for the Resource and Delete a Share buttons are added to the dialog box. You can have multiple shares for a single directory--you just have to name them differently.
Creating a Share by Using Server Manager. Server Manager is another administrative tool that serves a number of purposes. You can manage both domains and computers using Server Manager. You can control which system is the primary domain controller, which services are active on a system, which resources are shared, and who is using the shared resources. One of the advantages of using Server Manager is that you can control these functions from a remote system. If you use Control Panel's Services function, it only affects your local computer.
To start Server Manager, choose Start, Programs, Administrative Tools, and then select Server Manager. The name of the program, in case you want to create a shortcut, is SRVMGR.EXE.
NOTE: For additional information on Server Manager, see Chapter 18, "Administering the Server."
Server Manager shows a list of computers in your domain. You can work on different domains, as well. Different icons are used to show whether the system is a server or workstation.
To create or manage shares for a computer, select that computer by clicking it. Then choose Computer, Shared Directories to open the Shared Directories dialog box, which is used to manage the shares on the computer you've selected.
To create a new share, click the New Share button to bring up the New Share dialog box (see Figure 23.12). One of the disadvantages of using Server Manager to create a new share is that you can't browse for the directory you want to share. You have to type the correct path into the Path field.
The Permissions button is disabled until you type something into the Share Name field.
Type the name of the share into the Share Name field. Then enter the path for the directory you want to share into the Path field. If you want to add a comment--and I encourage you to--you have a field for that as well.
There's a User Limit frame at the bottom of the dialog box. This enables you to control the number of users who simultaneously access the share you're creating. The default, as shown in the figure, enables access for an unlimited number of users. If you want to create a limit, click Allow, and then specify a value.
That's how you create a share using Server Manager. As I said earlier, one of the reasons you might use Server Manager is that you can create and manage shares for other computers on your network. You can't do that from the Explorer.
Using DOS Commands to Create a Share. The NET command in many network implementations of Windows, including Windows NT, is used to administer many networking functions including shared resources. One of the ways you can use the NET command is to combine it with SHARE to create, change, or delete a shared resource. Here's the syntax:
C:\>net share /? The syntax of this command is:NET SHARE sharename sharename=drive:path [/USERS:number | /UNLIMITED] [/REMARK:"text"] sharename [/USERS:number | /UNLIMITED] [/REMARK:"text"] {sharename | devicename | drive:path} /DELETE
Here's an example of how you can create a share by using this command:
C:\>net share JimsShr=c:\runner /remark:"This is the RoadRunner software." JimsShr was shared successfully.
You can change the properties, including the number of users allowed to use a share at once or the comment associated with a share.
C:\>net share jimsshr /users:5 /remark:"RoadRunner software for five users." The command completed successfully.
As you can see from the command syntax, you can also delete a share using the /DELETE switch. The most common reason for using DOS commands to manage shares is that the commands can be included in a script. That way, you can easily set up shares for testing purposes and so on.
You might have noticed that you cannot maintain share permissions by using the NET SHARE command. The next section describes how to maintain share permissions in other ways.
Managing Share Permissions. Maintaining share permissions is very similar, whether you use Explorer or Server Manager. For this discussion, Explorer will be used. Click the Permissions button in the drive's Properties dialog box (refer to Figure 23.11) to open the Access Through Shared Permissions dialog box shown in Figure 23.13.
To add authority to use the share, click Add. To remove authority, select the user or group and click Remove.
To add permission to use the share, click Add to open the Add Users and Groups dialog box, as shown in Figure 23.14. This dialog box can show the users and groups, both local and for the domain. Click Show Users to see the users instead of just the groups. You can change which domain you're using by selecting a different domain in the List Names From drop-down list.
This is where permissions for shares are maintained.
In this example, a specific user is selected and given No Access authority. By default, the Everyone group has full authority. The No Access permission overrides the Full Authority for this one user and he won't be able to use the share. To do this, select his name from the Names list box, and either double-click it or select it and click Add. That puts his name into the Add Names list box at the bottom of the window.
Then select No Access from the Type of Access drop-down list. Until you click OK, the permission isn't set. Change the authority to No Access and click OK.
Figure 23.15 shows what the permissions for this share look like after you've finished. The added user is listed at the top with No Access and the Everyone group still has Full Control. Click OK in this dialog box and the share dialog box to complete the process.
In this example, the user now has no authority to the share. This overrides the authority that the group Everyone has.
It's important to understand that share permissions are separate from file permissions. For more information on groups, users, and authority, see Chapter 21, "Administering Users and Groups."
There are a number of ways to see what you've got shared on your server; you'll learn a couple of them here. The easiest way is to use Server Manager. As you saw earlier with Server Manager, you not only can see what's shared but also can change those shares. So my first choice when I'm trying to figure out what resources are shared is often the Server Manager.
If you like to type DOS commands, there's another option. Using the NET SHARE command by itself shows you a list of the shares on your system (see Figure 23.16).
Use the NET SHARE command to see what resources are shared on your system. The share name, resource, and comment are listed.
Those are just a couple of ways you can review the shares you've created on your server. Of course, you can always use Explorer, as well.
Another valuable piece of information is who's using the shares on a server. If you need to bring down the server, this information is necessary so you can let those people know to stop using the shared resources.
Again, Server Manager is the answer. Start by double-clicking a computer in the list or choosing Computer, Properties. This brings up the window shown in Figure 23.17. This is where you can see any shares currently in use. You can see in the Usage summary that there's one share in use, so you need to investigate further who's using that share.
This window gives you quite a bit of information. You can tell if shares are being used, who's logged on, and which shares are set up.
Click the Shares button to see a list of the shares available on that system (see Figure 23.18). Also listed in this window (under the column labeled Uses) is the number of users using that share. By clicking a share that has Uses greater than zero, you can see who's using that resource.
In this case, someone logged on as Administrator is using one of the resources on my server. I can disconnect that user by clicking the Disconnect button. That might cause
significant problems, however, so I don't recommend it. If you need to restart the server, talk to the user and ask him to stop using the resource. That way, you don't run the risk of getting in trouble if the user loses data.
This shows that a user is using a resource on the server.
Another way to see what resources are in use is to use the NET SHARE command again (see Figure 23.19). You need to specify which share to review. In this example, I'm reviewing the share JIMsShr to see if it's in use, and I see that the resource is in use by the Administrator.
Here I'm using the NET SHARE command for a specific share to see if it's in use.
Printer sharing is an important requirement for any NOS, including Windows NT Server. There are at least a couple of ways for sharing a printer on a network under Windows NT.
Start the Administrative Wizards tool by choosing Start, Programs, Administrative Tools, and selecting Administrative Wizards. Highlight and click the Add a Printer option, as shown in Figure 23.20.
The first window in this process lets you pick whether the printer you're configuring is attached to your local system or another system on the network (see Figure 23.21). In this example, the HP DeskJet is attached to the local system, so the My Computer option should be selected. Click Next.
Use the Administrative Wizards tool to add a printer that you're going to share on the network.
Use this window to select whether to create a printer that's locally attached or that's on the network.
The next window enables you select which port the printer is connected to (see Figure 23.22). The printer in this example is on LPT1 so that port should be checked. You can also enable printer pooling by using the check box on this window.
Use this window to configure which port the printer is attached to.
Printer pooling enables you to associate two or more devices with one configured printer. You can use this if, for example, reports are being tied up waiting for one printer. If you add a second printer and pool it, the user can print to one location. The system decides which printer is free and sends the spooled file to the correct printer. Click Next after you've selected the port.
You'll often see Microsoft refer to "print devices" and "printers" as separate items. A print device refers to the hardware that does the printing. A printer is the software and interface in Windows NT that enables you to print on a print device. It's that difference that enables you to have printer pooling with which a printer can print to more than one print device.
Select the printer type in the next window (see Figure 23.23). You can either select from the list or, if the printer manufacturer supplied a disk, click Have Disk. In this example, select HP, and the list on the right changes. Find DeskJet 540 in the list on the right and select it, and then click Next. If you haven't loaded the driver for this printer before, you might need to load your Windows NT software CD so the driver can be loaded.
This is where you select the manufacturer and model of the printer.
If you've loaded the driver for the printer before, you'll see a window that enables you to use the existing driver or load a new one. If it's already loaded, just click Next.
The next window enables you to name the printer. This is the name you'll see when you open the printer control panel, for example. Supply a name, and click Next.
Specify the sharing options for this printer in the next window (see Figure 23.24). Click Shared. The wizard fills in a suggested name in the Share Name field. You can enter up to 80 characters in this field, but the wizard suggests that you use eight or fewer so the printer will work with all clients.
The next step on this window is to select which operating systems you want drivers loaded for. For this example, select Windows 95 and Windows NT 3.5x for Intel processors. Click Next, and the wizard asks whether or not you want to print a test page. Click Finish. At this point the wizard prompts you for a Windows 95 CD and a Windows NT 3.5x for Intel CD. It loads the drivers from those CDs and you've got a shared printer.
If you've already got a printer configured on your local system but want to make it available on the network, one starting point is the printer control panel. To get to the printer control panel (see Figure 23.25), choose Start, Settings, Printers.
This is where the printer you've created is shared. Enter the share name for the printer and what other operating systems you want drivers loaded for.
I've got a DeskJet already configured and am going to share it on the network.
Right-click the printer you want to share, and choose Sharing. The window used to maintain sharing information appears. To share the printer, click the Shared option, enter a name for the share, select any additional operating systems you want to load drivers for, and click OK. When you click OK, the printer will be available on the network. Next time you look at the printer in the printer control panel, a hand underneath the printer tells you the printer is shared. The NET SHARE command works just as well to share a printer. However, I went through two of the easier and more common methods for sharing a printer.
Printer permissions are very simple, but they work differently than share permissions. Share permissions are a separate thing from file or directory permissions. There is no different authority for a local or remote printer. You simply use the Security tab from the printer's Properties window. The permissions you set apply to both local and remote users. There are four types of permissions that apply to a printer:
Unlike share permissions, you only have one place to go to set printer permissions. As far as managing the shared printer queue is concerned, simply go to Network Neighborhood and double-click the printer--the queue for the printer is displayed. You can delete and hold documents just as you would for a printer on your local system.
© Copyright, Macmillan Computer Publishing. All rights reserved.