Refusing access to home network just to one user account in windows

Question

I'd like to set up a guest account on my laptop so that people can use it at my home, including internet access as usual via my wifi router, but not access the drive shares on my LAN. I have the following drive shares:

• 2 Windows 7 computers sharing a home zone
• 1 Linux server with unprotected Samba shares

The laptop is currently running XP, but I could install Windows 7 on it if necessary.

The laptop does currently not see the Windows 7 computers (due to the home zone), so all I'd have to do is to keep it from accessing the Samba shares for that particular XP user account.

I don't want to password-protect the Samba shares for everyone else though since I am too lazy to type the password over and over again when working on my regular computer.

What's the easiest way to achieve this? I guess installing a domain (Windows or Samba) would solve the problem, but it looks like complete overkill for this scenario. Some kind of personal firewall on the laptop with different settings for different users might be another, but I don't know any.

Any ideas would be greatly appreciated! :-)

Answer 1

I still could not find a way to access restriction on a per-user basis, so the solution I used in the end is to create 2 equal shares on the samba server: Both point to the same drive directory, but one share works withh and one without a password. Next, I disallowed access to the password-less share to the laptop via "hosts deny" in smb.conf.

Now I can access the drive shares without a password on my regular computer and with a password when working on the laptop. Guests don't have the samba password, so they have to stay out.

Answer 2

I would tackle this from the point of view of the machines which host the shares. Simply add the 2/3 names of the 'Good Guys' on each share. Just don't add the guest.

Then when the 'Good Guys' try and access the share, they get in. They don't have to give a password at this point (only the once when they logon to their machine).

Answer 3

Setup two virtual LANs on your router. Turn wireless security on for one of the LANs and point your two windows 7 and your linux machine to that LAN, and point the XP machine to the other.

Answer 4

Overviewe of Windows SteadyState.

Windows SteadyState includes the following features to help you manage your shared computers: Windows Disk Protection – Help protect the Windows partition, which contains the Windows operating system and other programs, from being modified without administrator approval. Windows SteadyState allows you to set Windows Disk Protection to remove all changes upon restart, to remove changes at a certain date and time, or to not remove changes at all. If you choose to use Windows Disk Protection to remove changes, any changes made by shared users when they are logged on to the computer are removed when the computer is restarted. User Restrictions and Settings – The user restrictions and settings can help to enhance and simplify the user experience. Restrict user access to programs, settings, Start menu items, and options in Windows. You can also lock shared user accounts to prevent changes from being retained from one session to the next. User Account Manager – Create and delete user accounts. You can use Windows SteadyState to create user accounts on alternative drives that will retain user data and settings even when Windows Disk Protection is turned on. You can also import and export user settings from one computer to another—saving valuable time and resources. Computer Restrictions – Control security settings, privacy settings, and more, such as preventing users from creating and storing folders in drive C and from opening Microsoft Office documents from Internet Explorer®. Schedule Software Updates – Update your shared computer with the latest software and security updates when it is convenient for you and your shared users.

Steady State User Restrictions described

Drive restrictions determine which drives are visible to the user in My Computer. You can select the option to hide all drives, show all drives, or select specific drives that you do not want exposed to the user. These include printers or removable storage devices.

SteadyState Accounts and Profiles

It's simple to create, modify, and remove user profiles with Windows SteadyState. There's no need to log in to the user account, edit the registry, or manipulate files or folders on the hard drive. You control all user restrictions directly from the main console. Rapidly assign high, medium, or low security defaults to each user profile.

Hope this helps you some.