Why does sharing the root C: NOT allow me access to some folders?

I want to access the user folders in C:\Documents and Settings on PC#2 on my network from my other PC#1. PC1 is running XP/Home and PC2 is running XP/Pro. When I share the root C: of PC2 on the network, I can access everything on PC2 from PC1 EXCEPT the user folders, and the WINDOWS and PROGRAM folders. Everything else works just fine. But when I try to access the user folders, I get a message that says Access is denied. All my usernames are System Adminstrators so that's not the problem. I also tried unchecking Simple File Sharing on PC2 and setting the access options manually, but that didn't seem to help either, unless I did something wrong. Why does sharing C: apparently NOT give access to user folders, and is there anything I can do to allow this access to occur?

Thanks for any response or suggestions.

 

This is because you cant and shouldnt share folders inside a profile in most cases. If you are trying to share for example My Documents, the best practice is to do this:

(make sure you have nothing open form this folder like a doc)

1.Open Windows Explorer
2.Go to c:\Documens and Settings\Profile Name
3.Left click on My Documents and hold the left mouse button down (for a drag and drop)
4.Drag the My Documents folder to C:\. When you do this Windows will automatically update your My Docs path, and so will programs like Office.

Now My Documents are in C:\My Documents right click on the folder and share it.

Now try and access it from the other PC. Thats all you should have to do in most cases.

Another thing to make sure of it is that both PCs are in the same workgroup.

If when dragging the folder to the new location you get message that you cant (happens in rare cases) as it is in use, you will find it will still create a folder called My Documents in c:\, and will leave a My Docs folder in your profile as well.

If this happens, go to the to My Docs link at the top of the left pane in Windows Explorer. Right click on it and you will see a path. Choose "Move" and browse to c:\My Documents.

Then share c:\My Docs and your off. In rare cases you will have to drag any left behind files in your profile's My Docs into c:\My Docs when you are done.

Later you can delete the empty My Docs folder from your profile, maybe it will need a restart 1st. It wont matter if you leave it there either.

Note putting My Docs in C:\ will do this:

a) Allow you to share it with others on the network BUT
b) If you have multiple users on the sharing PC, when they log in they will also now be able to see your My Docs as it is in a public area (c:\) and not a private area (your profile)

When i build new PCs, i move My Docs to C:\ in all cases before they get the PC. This is also because in C:\ the My Docs folder is easier to find and back up.

Hope this helps

 

To take a different tack, the reason why you are having the problem is because there are TWO levels of privilege : Share privilege and file privilege.

By setting up a share to the root C directory you are giving a user or group of users share permission to remotely access the file system at the root of the directory.

However, the important point is that this does not effect the file permissions. That is once you've accessed the root via the share, you still have the same rights to files as you would if you were logged to the PC directly. To access the files you want to access, you also need to change the file permissions so that once you have connected, you are also able to access the folder and files you wish. Profiles in the "documents and settings" folder have file privilages set to restrict access to the own of that profile only. Therefore, by default if you access the system remotely, only the owner of the profile will be able to access the profile folders and files.

This is a common mistake that people fall into when sharing files.

So some comments:

Sharing the root directory is ALWAYS bad practice.

Set asside a location for storing shared files and share that only. If you have to share folders within a normal area of the disk, share only that part.

Working this way will make it easier to navigate to the right files from the remote connection (because the paths will be shorter) and will be much more secure.

Personally, I wouldn't mess about with the profiles, but you may find Dez's solution fits your needs.

 

Thanks to both Dez and Reggie for your comments and suggestions. Reggie said one thing that I do not understand:

Is it possible to change the access restrictions of the user folders in the "documents and settings" folder by changing some characteristic of the "documents and settings" folder itself? Or do the access restrictions of the user folders all have to be changed individually?

Also, Reggie said that "by default" only the owner can remotely access the user folder; does this mean that there is some other option besides the "default "? If so, what is this option and how do I access it?

thanks again for your comments.

 

Short of getting XP-pro for both PCs I'm not sure there is a good fix. "Simple File Sharing" can also be called "Limited File Sharing" and there are things it cannot do.

 

I have another approach but thats just me.

I dont share the folder at all. If I want to access a folder I type in the address bar \\computername\C$ and browse to what I want to get to.

 

My first reaction would be yes, but you may well break the system by doing so. That is when the user next logs onto PC2, the system will see the profile as corupted and generate a new profile in a new folder (e.g. user.000). Then everything falls about your ears. Playing around with access rights to user profiles is asking for trouble.

However, Newt's point is good. Using XP Home, with its restricted network setup may well also be limiting your connectivity (I can't advise more on this as I have a limited familiarity with XP Home - I don't like, so I don't use it).

So for my part I'm back with "what you are trying to do is bad practice ". Rather than trying to force the system to work the way you want (with the very real possibility that you will break the system by doing so), find a better way to share the data you are trying to share.

That will only work if you have Administrator rights, and has all the associated problems of simply sharing the root of C:. All you've done is hidden the share (by using a $). I wouldn't recommend it as a "standard" way of connecting.

 

I Gotta go with ReggieB

I have one partition ( and one only. And it is not the C: drive. ) that I share with the other two machines. And then ( in my case ) it is only shared if I wish to transfer some files from here to one of the other machines. What others can't see they can mess up.

BillyBob

 

Thanks to all who responded to my original question. My original goal was to find a way to access the user folders inside "Documents and Settings" from another PC on my small network. After a lot of experimenting I found two ways to do what I wanted:

1. Share "Document and Settings" and add the "Guest" user to each user folder inside "Documents and Settings." This has the advantage, from my point of view, of only causing one entry to appear in the "My Network Connections" display of the other PC. But this method has the disadvantage of requiring two changes to the security settings in order to accomplish it.

2. The second method, which I decided to use, is simply to share each user folder without changing "Documents and Settings" at all. But this seems to work only when the owner causes the share to occur. When I tried to share all the user folders from one administrator account, only the user folder of the administrator could then be accessed from the other PC. After some investigation, I think what happens is that when the owner causes the share to occur, then the "Everyone" user is added to the user folder security list. But when an administrator who is NOT the owner causes the share to occur, then this does not happen.

Complicating all of this for me was that the "My Network Connections" display is apparently not very accurate. As far as I could tell, when a folder is shared, then it appears in this display. But when the share is removed from the folder, the share name is NOT removed from the "My Network Connections" display. I finally decided, however, that the folder names displayed in "My Network Connections" are only shortcuts and can be deleted without affecting the folder itself. The display doesn't say that anywhere but that seems to be what happens.

I acknowledge the comments about "bad practice." I agree that sharing C: or other high level folders would indeed be bad practice in settings where a large number of computers and users exist. But in small settings (4 users and 3 computers) I think security considerations are different. In such a setting, nobody can stop a malicious user, but any serious destruction would most likely be quickly discovered. My experience has been that security settings are often more trouble than they are worth in small settings because they tend to complicate the work that users are trying to do without providing much additional protection.

My only final comment is that I am both amazed and irritated that these security settings (and other features) of Windows/XP are not better documented. I remember the days when you actually got a printed manual with your new computer. It was much easier to figure out your system than the current situation where you have to read the documentation online while you're trying to modify or setup the same PC you're using.

In any event, my system is now working the way I want it to, so thanks again to all who commented.

 

First I'd state that I am glad you have the system working the way you want. Also I thoroughly agree with your comments about good documentation and wanting to be able to set the system up the way you want to. I think the most annoying thing about modern Microsoft products is that they funnel you into working the way Microsoft thinks you should rather than providing the tools to work the way you want to.

I've found this thread particularly difficult to contribute to as in my head I've had the question "what advice can I give that will not lead the user to do something that will either break their system, or make it very insecure." I'm also conscious that others read these postings and therefore it is very important to promote good practice.

Using the guest account makes me very nervous. If a worm hits that network, I think it is going to find it very easy to infect all the PCs. I'd suggest creating a new user group and replacing the guest permissions with permission to the new group.

Also, are you sure you need to share all of the "Document and Settings" folder? Could you achieve your target by sharing each users "My Documents" folder within "Document and Settings ". That would restrict access to only the users' documents, and prevent accidental or intentional coruption of important settings (in the "Local Settings" and "Applications Data" folders for example).

Finally well done for getting the system to work the way you want inspite of our protestations for you not to. However, I hope you will take on board my concerns and bear in mind that there are implications to the security of the system in what has been set up.

 

Just a Hint

And something to think about.

I had heard about that before but had not seen it in print.

BB

 

Thanks Reggie again for your response. Sorry to be unclear - what I DID do was share the "My Documents" folder within the user folder. I suppose that seems like the obvious way to do it now, but I was hoping to avoid having to do that for every user folder. I was hoping to make just one change (perhaps to "Documents and Settings ") and be done with it. But, as I said, that apparently wasn't possible, so I did end up sharing "My Documents" within each user folder.