File & Print Sharing for admin only

[shorty610]

Does anyone know if it is possible to set File & Print sharing to be available for local Windows XP Pro Administrator accounts only? I want it disabled for User accounts. A batch file would be preferred, but if there are registry entries that could do this, that could possibly work as well. All help is appreciated! Thanks!

[gosh]

Download tweakui

Access control > Manage file and print sharing > click 'change', and select who you want

-gosh

[shorty610]

This is something I would like automated (whether winnt.sif, post-installation batch file, registry entry...), part of an unattended installation initiated by a KBOX System Windows XP deployment. Each time a user logs in to the network, a local profile will be created, and ideally the File & Print sharing is disabled. But the local admin profiles should have it enabled. The image will be getting deployed to hundreds of PCs... the more automation the better!

[gosh]

All tweakui is doing is setting permission on a registry key. To find the key download regsnap, make a snapshot, use tweakui, make another snapshot, and compare the two.

You can use an inf file to deploy registry permissions. All you do is use the cacls command and paste the output into an inf file. If you want an example of what youll need to do look at defltwk.inf located in your inf directory.

[Registry Keys]

"MACHINE\Software",2,"D:P(A;CI;GR;;;BU)(A;CI;GRGWSD;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"

;Same as parent, but this is the target of a symlink - set explicitly.

"MACHINE\SOFTWARE\Classes",2,"D:P(A;CI;GR;;;BU)(A;CI;GRGWSD;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"

"MACHINE\SOFTWARE\Classes\helpfile",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"

"MACHINE\SOFTWARE\Classes\.hlp",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"

Youll need to make your own inf and deploy it, or youll need to change the default setting, probably contained in defltwk.inf for workstations (for servers it's a different inf file)

-gosh

[shorty610]

My apologies for not clarifying this earlier, but I'm not actually looking to adjust the permissions to the File & Print sharing. I am wondering if it is possible to disable the functionality altogether (ie uncheck or uninstall "File and Printer sharing for Microsoft Networks") for User accounts, but have it enabled (turned on or installed) for Administrator accounts. Thanks.

[shorty610]

From what I can tell, the default settings for User accounts will be sufficient after all. Even though the File and Print sharing is "turned on," sharing still isn't allowed. That's good enough for me!

[eyeball]

either that or you can configure the windows firewall exceptions through group policy if you are in a domain environment