The following is my How-To on Access-Based Enumeration.
The domain: marvel.local
The server: deadpool
(Shared Folder) - \\deadpool\userdata
\\deadpool\userdata\Beast
\\deadpool\userdata\Cyclops
\\deadpool\userdata\Havok
1. |
Create a top-level folder that you will shareCreate a folder that you will share. |
|
---|---|---|
2. |
Create Sub-foldersCreate additional folders under the folder that will eventually be shared. My example folders: Beast, Cyclops, Havok |
|
3. |
Share out userdata folderGo to the properties of the userdata folder. |
|
4. |
Disable Inheritance/Remove default permissionsGo to Properties of userdata |
|
5. |
Add "List folder / Read Data" permission to Shared folder ONLYWhile still in the permissions tab click "Add" |
|
6. |
Create Security GroupsAt this point create security groups that will be delegated Read/Write access to each folder.
|
|
7. |
Delegate access to foldersMy example: Cyclops Go to the properties of the folder |
|
8. |
Add user to Security GroupAt this point add a user to the security group that was granted modify access in previous step. |
|
9. |
Turn on Access Based EnumerationOpen Server Manager |
|
10. |
Test Access-based enumeration by logging inLogin as account and access the share. You should only see the folders that you have rights to read (through membership to a security group that has been granted rights to that particular folder) |
Conclusion
Access-based enumeration is about NTFS permissions that the Share actually cares about.