Workgroup

[ale52]

Next week I'll be replacing a 'server' computer on a workgroup. The 'server' is a Dell 4300 (I think) with XP/SP2. It has a networked tax application (Lacerte) that is accessed by each workstation (3).

My question is: when I replace that computer should I leave the "everyone" (default) for access to that new computer or should I add each user that is currently on the network?  If I leave it default should I be able to use that networked application without having to add all the current users?

I personally don't like leaving the "everyone" group with permissions but rather put each user in. However, being this is a small workgroup and each system is turned off at the end of the day, it isn't such a risk. They are behind a hardware firewall, use XP's software firewall and all are using antivirus and antispyware software.

Alan <><  

[Rob Pomeroy]

Presumably this is with a company that doesn't take its security very seriously?  XP as a server?  I don't think so!

Okay okay, work with what you've got.  Are you replacing the machine with another XP box?  Your problem lies in authentication.  The "Fred Bloggs" known to the "server" is not the same "Fred Bloggs" listed as a user on workstation 1.  They have different SIDs; you can only really enforce user level permissions where you have a domain controller - i.e. a Windows Server/SBS or a Linux Samba box.

I would say that unless you install a real server, doing anything other than what was done before would result in a lot of pain.

[ale52]

Hey Rob...

Presumably this is with a company that doesn't take its security very seriously?  XP as a server?  I don't "think so![/i]  Small office / cheap people (but nice) / limited budget / limited knowledge of networking, security, etc.  
 
Okay okay, work with what you've got.  That's what I'm forced to do  
Are you replacing the machine with another XP box?   Yes.  XP Home no less :-/

Your problem lies in authentication.  The "Fred Bloggs" known to the "server" is not the same "Fred Bloggs" listed as a user on workstation 1.  They have different SIDs; you can only really enforce user level permissions where you have a domain controller - i.e. a Windows Server/SBS or a Linux Samba box.  So if I recreate a user on the new 'server', then recreate that user on the workstation, then both should have that same SID, right?
 
I would say that unless you install a real server, doing anything other than what was done before would result in a lot of pain. I guess I love pain   because that's what I'm up against.

Next Thursday is really gonna suck!  

Alan <><  

[Rob Pomeroy]

if I recreate a user on the new 'server', then recreate that user on the workstation, then both should have that same SID, right?

Not at all, I'm afraid.  The SIDs will always be unique to the machine, when you're not using domain-level authentication.  XP Home will just try the local username and password against any remote machine, and there's no way of changing this that I'm aware of.  So using the same username and passwords on all machines should work.  But you won't be able to get group level permissions working correctly because XP Home is too thick for that.

Can't they buy some greyware XP Pro OEM licences from eBay?  (I can't believe I'm suggesting this!)  The security implications of what they are doing are quite horrible.  I do hope they don't have any wireless cards or in fact any kind of internet connection...

[ale52]

Sorry...I'm showing my ignorance here    You're absolutey right.  

I'll need to do some homework between now and next Friday (not Thursday) and see what I can do.  

Thanks Rob.  

Alan <><  

[Rob Pomeroy]

Sorry...I'm showing my ignorance here

Hah, I do that all the time!