2

I have a network share (SMB) on our file server (Windows 2012 R2) that will be holding sensitive data. I am trying to figure out how I can limit access to not allow anyone accessing the share to download the files/folders. Is this possible?

user10141019
  • 21
  • 2

2 Answers2

2

You can specify who has the rights to read and write files. But if you give users the right to read files, the can read the files. That is the point of allowing them read access. You can set the rights so nobody can read the files, but then why place them in a network share?

RalfFriedl
  • 3,108
  • 4
  • 13
  • 17
  • There's a list permission too which will simply enumerate the files without allowing read or write – spacenomyous Aug 02 '18 at 23:36
  • Yes, there are some special permission, too, but what is the point to allow list but not read and write? In special cases you may deny list so that only users who know the exact name can access the file, but that doesn't apply here. – RalfFriedl Aug 03 '18 at 05:06
1

This is a problem that's generally solved with an administrative policy rather than via technical means. For example, you could force users to sign something saying that if they download the files off the network share onto any other device it's a termination-level offense before granting them permissions to access the share.

You might also want to turn on auditing on the share to see who's accessing which files, but I don't believe it'll alert you if they copy the files elsewhere. (Auditing would tell you that they accessed the file if they read or copy it. Writing the file to another device would require auditing on the other device for writes. Also, you would need to read the event viewer to see the audit information.) While you're at it, you probably want to disable USB devices, block access to cloud services on workstations used to access the files, etc., and none of that is a guarantee.

So, to answer your question, it's probably not possible to prevent it via technical means. This is why most people create an administrative policy instead.

Katherine Villyard
  • 18,550
  • 4
  • 37
  • 59