Cross-computer permissions?

[flarn2006]

Alright, so here's my situation. I've got the following network setup:

• (FLARNNB) Laptop running Windows XP Professional SP2 (Well actually Home with the setupreg.hiv hack; see my blog)
  
• (NORTON) Desktop running Windows XP Professional SP2 (for real)
  
• MI424WR router for Verizon FiOS
  
• Workgroup called MSHOME
  

Now I want to be able to have permissions across both computers (FLARNNB and NORTON) without needing to buy another computer or a copy of Windows Server 2003. What I'm saying is I want to be able to access other computers (users/groups, file permissions, etc.) over the network without getting permissions errors and stuff like that. For instance, say I want to view the registry on NORTON from FLARNNB. I load regedit, go to File and click Connect Network Registry. A Select Computer dialog appears. I type NORTON and click OK. It hangs for a while, and then eventually says "Enter the name and password of an account with permissions for NORTON." I have tried different things here, including typing in my account on FLARNNB (the computer I am on) which is Owner, and my password, which is CENSORED. I have also tried typing in the name of an account and password on NORTON, even one with the same exact name and password as my account on FLARNNB. I have also tried appending NORTON\ to the username. It then hangs again, eventually giving me an error message which I cannot remember. Trying a remote shutdown (with the shutdown command) gives these same results, except it doesn't ask me to provide a name/password for an account with permissions. The same happens when I select a shared file, go into the Security tab, and set Allow or Deny permissions for an account on another computer.

I'm stumped. What should I do?

Edited July 13, 2008 by flarn2006

[Mr Snrub]

Take a look and see if turning off "simple file sharing" is what you need...

Click Start / My Computer

Click Tools / Folder Options

Select the View tab, scroll to the bottom of the list

Un-tick "Use simple file sharing (Recommended)", click OK

Log off & back on again

Do that on both XP machines, accounts which do not have blank passwords should now be able to authenticate remotely.

[flarn2006]

Take a look and see if turning off "simple file sharing" is what you need...

Click Start / My Computer

Click Tools / Folder Options

Select the View tab, scroll to the bottom of the list

Un-tick "Use simple file sharing (Recommended)", click OK

Log off & back on again

Do that on both XP machines, accounts which do not have blank passwords should now be able to authenticate remotely.

Simple file sharing is already off on both machines!

[Mr Snrub]

Well I'm stumped then - networking XP machines in a workgroup is usually straightforward, but I don't know the implications of hacking XP Home to appear as XP Pro.

Client machines in workgroups have no common authentication authority, and no way to guarantee the identity of other computers - so it is not possible to add computer or user accounts from other machines, that is what a domain provides.

I have a clean-installed XP SP3 virtual machine in my home workgroup, and browsing my W2K3 or Vista machines prompt for authentication - once I provide credentials for the remote machine I am able to see the shared resources.

In the properties of a given network interface there are 2 requirements to get access to shared resources working:

Browsing shared resources on remote machines is provided by the Client for Microsoft Networks (this effectively connects the Workstation service to the network interface).

Sharing of files & printers is provided by File and Printer Sharing for Microsoft Networks (this effectively enables Named Pipe support in the Server service on the network interface).

The Windows Firewall needs the exception for File and Printer Sharing on the machine that will be sharing resources.

(If a 3rd party firewall is used then check its documentation for how to permit file sharing.)

If the Guest account is enabled on a machine with shared resources, then anonymous browsing of the computer's shares should be possible (you can still have security on the individual shares themselves if required).

[flarn2006]

I have a clean-installed XP SP3 virtual machine in my home workgroup, and browsing my W2K3 or Vista machines prompt for authentication - once I provide credentials for the remote machine I am able to see the shared resources.

Wait, wait...how do you enter the credentials? Do you enter the credentials of an account on the computer you are connecting to, or the one you are connecting from? Is there an account with that name and password on both computers?

[Mr Snrub]

You always authenticate with credentials recognised by the service you are connecting to.

In the case of standalone machines (as in a workgroup), this is the local Security Account Manager (SAM) database.

In the case of a domain member, it is the local SAM or a domain account (in which case a Domain Controller is contacted).

I am logged onto the XP virtual machine with an account which does not have a password, and when prompted for authentication I use credentials on the Vista or W2K3 machine to which I am connecting.

(And I do not need to pre-pend the user name with "MACHINE_NAME\" either.)

In the case of the Vista machines, the account name is the same, but not the password.

In the case of the W2K3 server, I am using completely different credentials.