Access NT 4 Workstation shares w/o password from XP

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

C P - 25 Nov 2003 04:42 GMT

I have an NT 4 Workstation (sp6) computer on my peer-peer LAN with my XP
Pro, and Win98SE laptops. I have Client for MS networks and File and
Printer sharing bound to NetBIOS, but not TCP/IP on all 3 computers
(although TCP/IP is installed on all 3 machines). On my XP or 98, I do not
log in with a user that has the same name as any of the users set up on the
NT machine. I am able to access the shares on my NT box from my 98 or XP
machines without entering any sort of user name/password to access the NT's
shares. This all works great.

I have a tester with a similar set up, but every time she tries to access a
share on her NT Workstation from her XP machine (XP Home I think), it asks
her for a user name and password before she can access the share (but the
share does show up in her XP's Network Places). I don't know what she's
doing wrong. Her share is set up properly (I think), and she's granted,
"Full Control" to "Everyone" in the permissions. On my NT, I tried messing
with the User Rights Policies for "Everyone", but I couldn't replicate what
she's seeing. She claims she has all the machines setup as part of a
workgroup, and not a domain, and she is stricly peer-peer like me (no
server).

Any hints?

Thanks,
Chris

Reply to this Message

Jiri Tuma - 25 Nov 2003 12:50 GMT

I think that the only difference is that your NT machine has enabled build
in GUEST account resposible for anonymous access. By default this account is
disabled, because anonymous access is considered as high security risk.

C P <nospam@nospam.com> p??e v diskusn?m
p??sp?vku:e8J6Z5wsDHA.2360@TK2MSFTNGP09.phx.gbl...

> I have an NT 4 Workstation (sp6) computer on my peer-peer LAN with my XP
> Pro, and Win98SE laptops. I have Client for MS networks and File and
[quoted text clipped - 20 lines]
> Thanks,
> Chris

Reply to this Message

C P - 25 Nov 2003 13:58 GMT

Hi,

I just checked, and on my machine, the only right that has been assigned to
"Guest", is "Log on Locally". The use "Guest" is member of only the
"Guests" group. I'm not sure what you mean by "your NT machine has enabled
build"? I don't see any security policy about enabling build.

Thanks,
Chris

> I think that the only difference is that your NT machine has enabled build
> in GUEST account resposible for anonymous access. By default this account is
[quoted text clipped - 32 lines]
> > Thanks,
> > Chris

Reply to this Message

C P - 26 Nov 2003 00:17 GMT

Sorry. I now see you were saying that my machine has the built in guest
account enabled. You are correct. However, my tester also has the Guest
account enabled, yet she is being asked to log in. I got some more info, it
turns out that she only has to enter a username/pwd when accessing a share
on the NT from her XP if she's NOT logged in as an admin user on the XP. If
she is signed onto the XP with an admin account, then she is not prompted
for a username/pwd to access a share on the NT Workstation. Since she has
no domain server (or any server for that matter), this seems odd to me.

> Hi,
>
[quoted text clipped - 47 lines]
> > > Thanks,
> > > Chris

Reply to this Message

Jiri Tuma - 26 Nov 2003 11:40 GMT

Logon locally right of you Guest account has nothing to do with anonymous
access. Anonymous access is maintaned via standard IPC$ sharing procedure
developed far at past for MS worgroup networks. However, NT based systems
are designed to be secure and than there is mechanism how to control this
access. NT system has two build-in (ie. existing on every machine)
accounts - Administrator and Guest. And Guest account settings are used to
control security of anonymous access. If you disable Guest account,
anonymous access is disabled. If you have Guest account enabled, anonymous
access is enabled too and is using the same password as Guest account (but
username is IPC$ not GUEST).

If you try to connect to share (without specifying user and password as part
of net use command) your OS will first attempt to use your username and
password to access share, if this do not match, your OS will try to connect
using IPC$ and empty password and at last it will display login prompt.

So if you want to access share without problem it is recommended to create
user account on server side machine with the same name and password as used
by user on client side machine - check account policy to be sure account
password will not expire - it is big timebomb MS prepared for admins, remote
users are not warned before password expiration!.

What to check now - check if there is not any password defined for guest
account on NT machine. In such case it will display login prompt if the
first username/password attempt failed. If she can connect share as admin
user, this user probably exist on NT machine with the same password or there
is firewall setting on XP machine allowing outgoing anonymous access only
for admin group. Try to disable firewall on XP machine and see if it helps.

C P <nospam@nospam.com> p??e v diskusn?m
p??sp?vku:OKiY7K7sDHA.2208@TK2MSFTNGP10.phx.gbl...

> Sorry. I now see you were saying that my machine has the built in guest
> account enabled. You are correct. However, my tester also has the Guest
[quoted text clipped - 65 lines]
> > > > Thanks,
> > > > Chris

Reply to this Message