Files, Folders, and Shares

Transcription

1 Files, Folders, and Shares One of the core functions of any server is to serve resources such as files and folders. In Windows Server 2008 R2, File Services is one of the key roles you can add. If you plan on sharing files and folders, it s important that you understand not only how to share the data but also how to protect it with permissions including both New Technology File System (NTFS) and share permissions. Although both sets of permissions work independently, they also interact with each other. 1

2 UNDERSTANDING THE FILE SERVICES ROLE The core component of any server is its ability to share files. Sharing resources means that you allow your users to access those resources from the network. No real processing goes into it as far as the server is concerned; it just hands out files and folders as they are. ADDING ROLE SERVICES 2

3 Server Manager includes several consoles that can be used to manage the different server roles including the File Services role. The File Services role includes several additional role services: File Server This is the primary role service required to support the File Services role. It is automatically added when a folder is shared. Distributed File System (DFS) DFS includes both DFS Replication and DFS Namespaces and is covered later. File Server Resource Manager (FSRM) The FSRM provides a rich set of additional tools that can be used to manage the storage of data on the server including configuring quotas, and generating storage reports. The File Services role includes several additional role services: Services for Network File System (NFS) This service enables you to grant access to files from Unix client computers. Windows Search Service The Windows Search Service uses indexing to perform quicker file searches. Windows Server 2003 File Services This includes the Indexing Service for backward compatibility with Windows Server 2003 File Services. 3

4 The File Services role includes several additional role services: BranchCache for Network Files BranchCache can be used in a multiple site environment to allow computers in branch offices to cache commonly downloaded files. BranchCache needs to be enabled on the shared folder. ADDING THE FILE SERVICES ROLE For this lab, take a linked clone of Server 2008, add in an extra hard drive (to be used for file shares) Set up a partition on the Drive using disk manager 4

5 You can add the File Services role by following these steps: Launch Server Manager by selecting Start Administrative Tools Server Manager. Select Roles, and click the Add Roles link. This image cannot currently be displayed. Review the information on the Before You Begin page, and click Next. Select the File Services role, and click Next. 5

6 Review the information on the Introduction to File Services page, and click Next. On the Select Role Services page, select the following role services File Server, File Server Resource Manager, and BranchCache for network files. Click Next. The Configure Storage Usage Monitoring page is used to identify which volumes you want to monitor. The File Server Resource Manager can monitor and generate storage reports on any volumes you choose to monitor. 6

7 Select the volume that you plan on using to share data. Select the second volume and Click Next. The Set Report Options page allows you to specify a location for storage reports. You can either accept the default location or browse to another location. You can also configure the reports to be ed if you have an SMTP server available to send the reports. For now, accept the default location, and click Next. 7

8 Review the information on the Confirmation page, and click Install. After a moment, the file services will be installed. Click Close. At this point, Server Manager includes the File Services role. Open Server Manager if it is not already open, It includes the Share and Storage Management node and several selections under the File Server Resource Manager 8

9 If you expand down to Share and Storage Management, the shared resources will be displayed Admin$ Windows Dir Inter Process Communication (IPC) share A network share on computers running Microsoft Windows. This share is used to facilitate communication between processes and computers, often to exchange authentication data between computers. CREATING SHARES There are several methods of creating shares First we will examine creating shares via server manager Once a share is created, it can be published to Active Directory to make it easy for users to locate the share. 9

10 CREATING SHARES WITH SERVER MANAGER The Share and Storage Management node includes a Provision a Shared Folder Wizard that you can use by following these steps: Launch Server Manager by selecting Start Administrative Tools Server Manager. Browse to the Roles File Services Share and Storage Management node, right click Share and Storage Management, and select Provision Share. 10

11 On the Shared Folder Location page, click Browse. Browse to a folder you want to share. You can create folders also in here Create a folder called Sales Click OK after browsing to and selecting a folder. Click Next. The provision storage button allows you to set up available free unallocated drive space. 11

12 The NTFS Permissions page gives you an opportunity to change the NTFS permissions if desired. Next to accept the NTFS permissions. On the Share Protocols page, you identify the protocols used to access the share and can also give the share a different share name. SMB is the primary protocol used by Windows clients to connect, and when this is selected, it allows both SMB version 1 and SMB version 2 depending on the client s capabilities. If you added NFS support for Unix clients, you could select NFS here. Accept the default of SMB, and click Next. The SMB Settings page allows you to manipulate some of the advanced settings by clicking the Advanced button. The User Limit option is set to Maximum Allowed by default, but you can limit it to a specific number of connections if desired. The Access based Enumeration setting is related to DFS and is disabled if the DFS role service isn t added. Offline Settings affects Offline Folders Click Next. 12

13 On the SMB Permissions page, you have the opportunity to change the default share permissions. By default, the Everyone group is granted Read access to the share. The Quota Policy page allows you to apply quotas to the share. If you wanted to ensure users were limited to no more than 100MB of storage space, you could create a quota policy to enforce the limit. The File Screen Policy page allows you to apply a file screen that can be used to monitor or block specific types of files from being saved on the share. You may want to ensure that users didn t store any audio and video files on the server, you could select the Block Audio and Video Files file screen. Click Next 13

14 If you re using DFS, you can publish an SMB share to a DFS namespace. Review the settings you ve selected, and click Create. After a moment, the wizard will complete the creation of the share and indicate success. Click Close. 14

15 PUBLISHING SHARES IN ACTIVE DIRECTORY The primary reason to publish a share to Active Directory is to allow users to easily find it. To publish a share, you need to be in the Active Directory Users and Computers Management Console. The share needs to have been created previously prior to publishing Right click the organizational unit of choice, and select New Shared Folder. 15

16 From there, you ll be asked to provide a name for this publication of the share and, of course, the actual share name. The share will then appear in ADUC Searching Active Directory If a client is a member of a domain, the Search Active Directory command appears on the Network console. You can launch Network by selecting Start Network on Windows Server 2008 R2. 16

17 MANAGING PERMISSIONS One of the great strengths of both NTFS formatted drives and shares is the ability to assign permissions and control who can access different files and folders. There are many similarities between NTFS and share permissions NTFS PERMISSIONS 17

18 NTFS permissions apply to any file or folder on a disk that has been formatted with NTFS. Read When a user is assigned Read permission, the user is allowed to view the contents, permissions, and attributes associated with a file or folder. Read and Execute The Read and Execute permission is used to grant permission for a user to execute files. If a user has only Read permission, and not Read and Execute, the files can t be executed. List Folder Contents The List Folder Contents permission allows a user to view the contents of a folder. It will allow a user to see that files exist in a folder, but will not apply Read permissions to those files. Write If a user is assigned Write permission to a file or folder, the user can modify the file or folder. This includes adding new files or folders to a folder or making changes to existing files or folders. However, it does not include deleting files from a folder. Modify Modify includes all of the permissions from Read, Read & Execute, and Change, and adds the ability to delete files and folders. Full Control Full Control is a combination of all the available permissions. It adds the ability to change permissions and take ownership of files or folders. SHARE PERMISSIONS Share permissions only apply to shares when they are accessed over the network. There are only three share permissions. Read Users granted Read permission can read files and folders within the share. Change Users granted Change permission can read, execute, modify, and delete files and folders within the share. Full Control Users granted Full Control permission have all the permissions from Change, and can also modify permissions on the share. 18

19 ASSIGNING ALLOW OR DENY If the permission is set to Allow for a user or group, the user or group has this permission. If the permission is set to Deny for a user or group, the user or group will not have the permission. Permissions are cumulative. If a user has multiple Allow permissions assigned (such as allow Read and Allow Change), the user has a combination of the assigned permissions. If both Allow and Deny permissions are assigned for a user, deny takes precedence. If there aren t any permissions assigned to a user, then the user does not have access to the object. This is referred to as an implicit deny. Both share permissions and NTFS permissions use the discretionary access control (DAC) model to control access. Each object has a discretionary access control list (DACL; pronounced as dackel ). The DACL is a list of access control entries (ACEs). Each ACE identifies a user or a group with their associated security identifier (SID) and Allow or Deny permission. 19

20 If multiple permissions apply to a user, the user has the combination of all the permissions. Deny Takes Precedence If both Allow and Deny for any permission are assigned to a user, Deny takes precedence. Implicit Deny If permissions aren t explicitly granted, they are implicitly denied. Anyone who is not given access, but also is not restricted access does not get any access by default, this is implicit deny 20

21 MODIFYING SHARE AND NTFS PERMISSIONS You can modify both the share and NTFS permissions using Server Manager, Computer Management, or Windows Explorer. Launch Server Manager, and browse to Roles File Services Share and Storage Management. 21

22 Right click the share, and select Properties. Click the Permissions tab, and then click the Share Permissions Tab. Choose either Share or NTFS permissions 22

23 Clicking on one of the buttons will open the relevant permissions (share or NTFS) accordingly Combining Share and NTFS Permissions Identifying permissions can be hard, keep it simple with these three steps: Determine the cumulative NTFS permissions. Determine the cumulative share permissions. Determine which of the two provides the least access (commonly called the most restrictive permission). Connecting to Shares Primarily, you connect to a share using the universal naming convention (UNC) of which follows the following syntax: \\ServerName\ShareName. You can also click Start and in the search box enter \\ServerName (using the server name of any server on your network) followed by a backslash, Once the operating system connects, it retrieves a list of shares available. 23

24 Mapping a drive You can map a drive letter to a share on your network. You can right click either Computer or Network from the Start menu and select Map Network Drive You can also right click on the share if you open up the server via its UNC and right click it and choose Map network drive COMMON SHARES C$, D$, and so on All drives, including CD ROM drives, are given a hidden share to the root of the drive. This share is what is called an administrative share. You cannot change the permissions or properties of these shares Only the Administrators and Backup Operators groups can connect to administrative shares 24

25 ADMIN$ The ADMIN$ share is another administrative share and it maps to the location of the operating system. PRINT$ Whenever you create a shared printer, the system places the drivers in this share. This allows the drivers to be easily downloaded when clients connect to the shared printer. IPC$ The IPC$ share is probably one of the most widely used shares in interserver communications though you will rarely interact with it directly. When you try to access shared resources on other computers (to read event logs, for example), the system uses named pipes. A named pipe is a piece of memory that handles a communication channel between two processes, whether local or remote, IPC$ is used by the named pipes. 25

26 NETLOGON The NETLOGON share is used in conjunction with processing logon requests from users. Once users successfully log in, they are given any profile and script information that they are required to run. SYSVOL The SYSVOL share is used to house Group Policy information and scripts that are accessed by clients on the network. You will always see SYSVOL shares on domain controllers, but they can be replicated to member servers. QUOTAS 26

27 Quotas allow you to monitor and limit the space users can consume on a volume or folder. When creating quotas, you have the ability to set warning limits, set enforcement limits, provide notification of reached limits via or event log entries, and even execute commands in response to any limit. You can use the quota policy to just monitor the usage. To manage Disk Quotas, you use File Services Resource Manager (FSRM), this is available via server manager roles, if you did not install it you can install it from Server manager Microsoft have included several quota templates in File Services Resource Manager (FSRM) that you can easily be applied as is, or you can modify them to fit your needs. You can even create your own templates. 27

28 Quota Types There are two types of quota hard or soft. A hard quota limit will enforce the limit and prevent users from exceeding the limit. A soft quota limit is just used for monitoring; it will provide notification but does not enforce the limit. To view Existing Quotas click Quotas under Quota Management Any existing quotas will be shown Creating a Quota from a template Launch Server Manager, and browse to the Roles File Services Share and Storage Management File Services Resource Manager Quota Management Quota Templates node. 28

29 Right click the 200 MB Limit Reports to User quota template, and select Create Quota from Template. Enter the path or click browse and browse to the folder you want to monitor in the Quota Path text box. View the properties 29

30 Click Create. The Quota will be created Modifying the Quota Select Quotas. Right click your new quota, and select Edit Quota Properties. The edit quota properties page appears 30

31 Select Quotas (right above Quota Templates in the Server Manager navigation tree). Right click your new quota, and select Edit Quota Properties. Change the Space Limit from 200MB to 500MB. Select the Warning (100%) notification threshold, and select Edit. 31

32 Review the information on the E mail Message, Event Log, and Command tabs. You may get a warning message indicating that an SMTP server is not configured Notice that you can modify the data on any of these tabs. The Tab The E mail Message tab allows you to configure an response if the threshold is reached. If you want an sent to an administrator, simply add the administrator s address on this page in the format of account@domain, admins@tombrett.local You can also configure it to send an to the user who exceeded the threshold simply by selecting a box. The templates include a preconfigured subject line and message body, and both can include variables (Source I/O Owner, Quota Path, Server etc.) When you can select any of these variables you can see a short explanation of what it is. 32

33 Event Log Tab You can configure the events to be logged in the Application log if desired. Selecting the Event Log tab and selecting the box to send the warning to the event log. Any events sent from here are logged into the Application log. Command Tab The command tab allows you to run a command or script when the limit is exceeded Report Tab You can configure reports to be generated in response to a threshold and automatically be sent via to administrators and/or the user. Reports can also be created on demand. 33

34 The reports are already configured. The Generate Reports check box is checked, and three reports are configured to be generated: Duplicate Files, Large Files, and Least Recently Accessed Files. Additionally, it s configured to send the report to the user exceeding the threshold. CREATING FILE SCREEN POLICIES File screens are used to filter or screen files to ensure certain types of files aren t stored on a server. You can create a file screen that will block users from saving specific types of files and generate notifications when anyone attempts to save these blocked files on the server. File screens can be created on entire volumes or specific folders, File screens also have templates. 34

35 Launch Server Manager, and browse to the File Screen Templates node. Right click the Block E mail Files template, and select Create File Screen from Template. Enter the volume name that you want to screen (such as C:\sales) in the File Screen Path text box. Click Create. 35

36 Select File Screens (right above File Screen Templates). Right click the new file screen you just created, and select Edit File Screen Properties. you can select either Active Screening or Passive Screening. Since you want to specifically block users from storing the files on the server, leave it as Active Screening. Click through the Message, Event Log, Command, and Report tabs. If a warning appears indicating that an SMTP server is not configured, review the information, and click Yes to continue. These are very similar to the tabs used with quotes. Only the notification content is changed. Click OK once you ve reviewed the tabs. 36

37 GENERATING REPORTS Several different reports are available. You can generate reports as part of any quota policy or file screen policy. You can also configure reports to be generated on a schedule or generate them on demand. The different reports available are Duplicate Files, File Screening Audit, Files by File Group, Files by Owner, Files by Property, Large Files, Least Recently Accessed Files, Most Recently Accessed Files, and Quota Usage. You can also save the reports in several different formats such as DHTML, HTML, XML, CSV, and text. 37

38 ACCESSING REPORTS Launch Server Manager. Right click the Storage Reports Management node within the File Server Resource Manager, and select Generate Reports Now. Click the Add button. 38

39 Browse to a drive or a folder, and click OK. You can add multiple drives and folders. You can select as many reports as you d like to view, if you select them all, be patient; they take some time to generate. Some of the reports have additional parameters that you can modify. if you select the Quota Usage report, you can click the Edit Parameters button and modify the minimum quota usage that will be included in the report. Click the Delivery tab. Notice you can add an address and send the reports via . Click OK. 39

40 Depending on the amount of data in the reports, this could take several minutes to complete. The relevant reports are created You can also schedule reports to run 40

41 The schedule tab appears Click Create schedule The Task Scheduler opens where you can schedule a new task by clicking new 41

42 BITLOCKER BitLocker Drive Encryption is a technology designed to provide protection for entire disk drives. BitLocker To Go is a newer technology that came out with Windows 7 and 2008 server and is designed to allow you to encrypt USB flash drives. Requirements A TPM 1.2 compatible chip Computers which don t have TPM 1.2. There are alternatives that can be used to encrypt drives with BitLocker: Password BitLocker can encrypt the drive, and a password can be used to unlock it. Smart Card BitLocker can encrypt the drive, and a smart card with a PIN can be used to unlock the drive. 42

43 Recovery Key Once TPM detects that it has been moved (or the hardware has been changed), it will lock the drive until the recovery key is used to unlock it. Enabling BitLocker Launch Server Manager. Select Features, and click Add Features. Select the BitLocker Drive Encryption check box Click Install. When prompted, restart your computer to complete the installation. After the reboot, log on. When the installation completes, click Close. Launch the Control Panel, and click System and Security. 43