Network sharing

anything I don't mind · 22 Sep 2011 at 11:41

I have recently been moved to a new site which has very sensitive information on it. They have an internal network not connected to the internet and an external one connected to the internet.

The IT person before me apparently was not very good and has rolled out 15 windows 7 machines with a poor image.

He has not done permissions correctly on a folder where files required updating. He has also disabled file and print sharing and network discovery on the clients.

Question: To make it easier and less disruptive i wanted to enable file and print sharing on the clients so that i could change permissions on folders remotely without having to physically go on to every machine.

In the past I have always enabled file and print sharing ability for clients as I did not see it as such a security risk. But as this is a high security place. I was wondering if you had any input on it?

Also do you know of a way to remotely change the advanced network settings on clients?

I can not even icmp the clients from the domain controller...

SMN · 22 Sep 2011 at 13:13

Sounds confusing to me. Take occams razor (The real one) to heart. Flatten the network, one LAN, firewall on the edge, problem solved.

anything I don't mind · 22 Sep 2011 at 14:01

It is the first time i have worked in a high security environment.

Apparently the guy might not have set up the clients in such a way on purpose and it was suggested that i should make them accessible for administration. I am just trying to find a way to do it remotely because i want to avoid going around to each pc. But I can't seem to find a way to enabled it remotely.

There is no chance of combing the two networks.

Ev0 · 22 Sep 2011 at 14:49

SMN said:
Sounds confusing to me. Take occams razor (The real one) to heart. Flatten the network, one LAN, firewall on the edge, problem solved.

Er not really, I'm guessing the 'air gap' network setup is there for a reason

Without knowing the company, what the data is etc you can't just say that. Is this in the financial sector?

If all you're needing to do is change permissions on some folders + files I'd go with a startup script that runs xcalcls or the like to set the permissions that you want.

DiCe! · 22 Sep 2011 at 15:07

Go around each pc, stop being lazy. sorted

anything I don't mind · 22 Sep 2011 at 15:16

Thanks, will use xcalcls to modify permissions.

What do you think about the pcs not being pingable? is that normal when network discovery and file and print sharing is disabled?

#Chri5# · 22 Sep 2011 at 15:30

First thing I'd check is for the W7 firewall blocking ping

Ev0 · 22 Sep 2011 at 15:35

Yup I wouldn't worry about not pingable, doesn't really matter unless something needs to be able to do so to function

As said probably just the firewall blocking it, no big deal.

If you need to be able to detect them on the network but not allow ping then look at using nmap with one of it's scan modes and no ping to see what's up.

If you get stuck with xcacls give me a shout, I used to do a lot of work with it in my software packaging days (but probably terribly rusty now!).

anything I don't mind · 22 Sep 2011 at 16:11

No the pcs do not even show up in windows "network" search.

The one PC that i was trying to connect to, to modify the permissions, was not reachable from the DC at all.

Ev0 · 22 Sep 2011 at 16:33

But if the pcs are still working (i.e. they still connect to the dc etc when logging on) then that doesn't really matter.

If file and print sharing is turned off then they won't be browsable, which I'm guessing is their point for switching it off.

From this point on just assume that when browsing to the machine anything windows share related is a no go.

teaboy5 · 23 Sep 2011 at 14:45

I dont see the point of the pc firewall being turned on in a domain envir?

J.B · 23 Sep 2011 at 21:06

teaboy5 said:
I dont see the point of the pc firewall being turned on in a domain envir?

ehhhh...what? Care to expand on that?

memyselfandi · 23 Sep 2011 at 21:41

SMN said:
Sounds confusing to me. Take occams razor (The real one) to heart. Flatten the network, one LAN, firewall on the edge, problem solved.

Agree with Ev0 ... I've come across cases, not just in the financial sector, where there have been requirements to "air gap" networks away from each other, (i.e. complete separate physical network infrastructures not just different firewalled/vlan'ed networks) ...

Without knowing the detail of the situation, and if it is something that requires this sort of thing then it is doubtful it should be disclosed on a public forum anyway, it is impossible to say whether the current topology is correct or not. Although edge security as you suggest, instead of security in depth, is a bit old school now as it doesn't take into account threats on the internal network.

OP, if this is a secure environment then make sure you understand the requirements before considering changing any access/security settings ... if it means you have to visit each machine that needs the change then so be it. If you are going to make any other changes then make sure that your **** is covered.

SoundsGood · 23 Sep 2011 at 21:53

Should be able to change most settings remotely using PSEXEC.

teaboy5 · 24 Sep 2011 at 22:49

J.B said:
ehhhh...what? Care to expand on that?

Because the pc will more than likely be behind an enterprise firewall which will not allow it to connect to the net unless it being pushed through a proxy.

If there is enough security there is no call for the firewall to be enabled on the pc at all.

IMO of course.

Ev0 · 25 Sep 2011 at 01:52

It's all about defence in depth

What if the enterprise firewall is compromised some way?

What if the threat is already within your network?

Many reasons why you would want a firewall in place on a machine within a network.

palmy · 25 Sep 2011 at 15:53

To me it sounds like you are out of your depth. If its a true 'secure' environment (which could mean a million and one things) then the consequences of what you are doing could have far greater ramifications than playing on a small office network.

Do you have any technical guidance internally that you can draw on? Do you have an internal change process that will review your proposals?

As already said, it sounds like a startup script or group policy would be the best method to resolve this without visting each machine individually.

Ev0 · 25 Sep 2011 at 18:08

I as going to say if it's been setup like this then I'd assume you have at least some security staff to advise, or a security architect or something to talk to.

Deleted member 77746 · 25 Sep 2011 at 19:37

The Lazy Admin. The first thing I would be doing is visiting random workstations to see the state of whats gone on if anything and rebuilding it but that's just me.

anything I don't mind · 26 Sep 2011 at 12:58

I spoke to the previous IT guy today and he said that he disabled file sharing on purpose for security. Which is ok. I won't have to change that, ill just change the permissions with a login script as advised by ev0.

It is just me with 40 users, i hope i am not out of my depth