Oh dear lord, I’ve just lost two days of my life trying to find the exact incantation to persuade a fresh install of Windows Server 2008 R2 to act as a file server on my home network. I did this last two and a half years ago, and it’s taken me two days to regain the knowledge.
Here’s the list of things you need to do to make it play nicely, both with anonymous / legacy accounts and operating systems, and to allow access control for protected shares.
- Add the file server role
- Modify the Local Security Policy –> Local Policies –> Security Options
- Network access: Allow anonymous SID/name translation = Enabled
- Network access: Do not allow anonymous enumeration of SAM accounts = Disabled
- Network access: Do not allow anonymous enumeration of SAM accounts and shares = Disabled
- Network access: Let Everyone permissions apply to anonymous users = Enabled
- Network access: Restrict anonymous access to Named Pipes and Shares = Disabled
- Network access: Sharing and security model for local accounts = Classical
- Network security: Do not store LAN Manager hash value on next password change = Enabled
- Network security: LAN Manager authentication level = Send LM & NTLM - use NTLMv2 session security if negotiated
- Flush your group policy like a boss (gpupdate /force)
- Control Panel\Network and Internet\Network and Sharing Center\Advanced sharing settings
- Turn on network discovery
- Turn on file and printer sharing
- Turn on public folder sharing
- Turn off password protected sharing (else nobody will be able to browse to machine names)
- Turn on the Guest user account
- Create any user accounts you want to give specific access to.
Now: Anonymous users will authenticate as the guest account, so “Everyone” network sharing will work fine, and you can specifically log on to the server as SERVERNAME\user for specific access rights on mapped network shares.
It’s just that easy.
Yeah.