OT: Sharing with Everyone Except one Guest user

[CynthiaG.]

I have a bunch of Dells, mixed Win7Pro & Win10Home. I have various folders on most PCs shared (Properties, both Share & Security set to Everyone, full access).

However, I would like to setup a Guest account on on Win7Pro PC [ACC] specifically for an outside person to log in and update one of our programs on an occasional basis. We would use Splashtop to give her access.

The problem is I don't her to part of the Everyone that has full access. In fact, I want to not be able to access anything outside of the ACC PC she will log into.

I tried adding the Guest and denying access, but that locks everyone out and the guest account only shows on the ACC PC and none of the others.

I thought maybe I could grant full access only to Administrators, but I cannot give access to the Admin account on the other PCs either.

There must be a way to share with "Everyone" except the Guest on PC ACC - isn't there? Thanks for any ideas you may have.

I used to practically live on this group when I had a Dimension XPS T and then a 4550 at home. This is my first visit in a very long time.

[Steve]

Hi,

In Windows terms, Everyone means everyone!

I was going to suggest that you created a Homegroup but then I found
that these have been discontinued in Windows 10 last year. So I would
suggest creating a Workgroup if you've not already done so.

A workgroup will allow you to restrict access to files and folders based
on the PCs being all in the same workgroup, and you knowing the
usernames and passwords of each user account on each PC in the Workgroup.

You would have to redefine the permissions on the shared folders by
removing "Everyone" and adding just the users you want (in your case,
not the Guest).

This article explains it better than I can here:
https://www.lifewire.com/definition-of-workgroup-816285

Steve

[CynthiaG.]

Thank you for your notes. I did try changing that PC [ACC] to a different workgroup. I had hoped that that would mean that it would no longer access the shared folders, but no luck. All folders are still available to it - even though all other PCs are on a different workgroup.

If I could just figure out how to block the network, but not the internet - that would be great!

I haven't figured out how to give access to the other PCs, the only names I get options for everyone or the user of the PC I'm working on. How do I tell each PC to allow access to a shared folder to a different PC/user? I hope that makes sense.

[Steve]

OK, there are two ways I was thinking of:

1.
All PCs have to be a member of the same workgroup. What the workgroup is
called doesn't matter as long as it's the same on each PC.
Each user has to have an account on each PC with exactly the same
username and password. They have to use a password, blank ones will
cause problems.
Once that's done you go to the shared folder(s) of the PC(s) and in the
permissions section of the folder properties you add each user to the
folder with the permissions you want them to have (Modify, Read, Write
etc). Add the PC Administrator account if it's not there, with Full
Control. Remove "Everyone". Test it out across the network from another
PC. A Guest user (or any other user that you haven't specifically added)
shouldn't be able to access the folder.
You'll have to do this on every PC with a shared folder. If you have
many PCs and users, it's probably time to get a server and centralise
things!

2.
The other way of doing it is probably easier but not as secure. You add
the Guest account to the permissions section of each shared folder
properties and click all the Deny boxes. That way although Everyone can
still get into the folder, the Guest is denied, because the most
restrictive combination takes effect. You may have to give the Guest
account the same password on each PC.



By the way you might want to check that the Guest can't access folders
on the local PC that you don't want them to. If the folders are inside
the "Users" folder you should be OK.

Steve

[CynthiaG.]

Thanks again.

I was thinking the same thing - I tried adding the guest account and clicking deny for it and everyone is OK. This then blocked everyone. it makes no sense, but that is what happened.

I have only one user (the admin) per PC.

The exception is the new Guest on the ACC system that I am trying to exclude from the network. I will be moving / deleting local files that she will able to access, once I figure out how to stop her having access to all.

All PCs have passwords, but they're not used much b/c we all auto logon (again, except ACC).

Cynthia

[Steve]

As you say, that makes no sense!
Sorry, there's something not right there. I don't know what it is. From
what you've described it should be the case that denying the Guest will
do what you want, not block everyone.

[CynthiaG.]

Thank you. I'm glad to know I'm not crazy and that it should probably
work the way I think. I'm sure I'm doing something very simple
incorrectly, but I haven't figured out what.