Win2003 – how prevent workgroup browsing

Topic

New Reply

I have a separate computer I will load Win 2003 (5 CAL) on. I want students to have access via the Internet (using Terminal Server / remote desktop). I do NOT want the students to be able to see the other computers using the same router. I tried setting up the odd (future Win 2003) computer as having a different workgroup, but it still sees the other workgroup. Because all of the computers are currently running XP, am I running into an XP “convenience” feature that can’t be turned off??? Do I have to (or SHOULD I) wait until my copy of Win 2003 arrives to lock down the odd computer? This is pretty exciting / cool, because we hope to use an old Win95 program as the hosted Terminal Services program used by max of 5 students at the same time — breathing new life into the program! Any cautions or resources I should check into to set this up?
.
Kudos to the WOPR folk… right when I am starting to get set with Win 2003, lo and behold, you have a new forum set up for just that.

Reply | Quote

Replies

When you say you don’t want them to “see” the computer, I assume you mean to be able to browse to it and access file shares – if you mean something else then please clarify.

Do you need File and Print sharing in the W2003 Server? If not you can turn it off. If you need File and Print sharing then you should protect all your shares, so that students can’t access them. You could also create only hidden shares (sharename ending with $) so that the students can’t even see that the protected shares exist.

StuartR

Reply | Quote

Is Win2k3 now installed? If you turn off F&P sharing it does not mean that the Win2k3 PC can’t see the network. It means that you can not have others on the network access files & printers on the Win2k3 PC. You might look at Microsoft Windows Server 2003 TechCenter. There are lots of articles on Win2k3 deployment & troubleshooting.

Joe

--Joe

Reply | Quote

If you want to prevent users from accessing shares offered by any other system then you could try stopping and disabling the Workstation service.

I’ve never tried running a Windows system with this service disabled, so you will need to do a bit of testing to make sure it doesn’t break any functionality that you need.

StuartR

Reply | Quote

I know there is some policy setting somewhere… Just where to find it… I should be able to say that users belonging to the “Remote Desktop Users” group cannot browse the network…
.
I did the quick and dirty to handle this. I set the IP address on the Win 2003 machine to a fixed IP, then blocked that IP on all of the other machines via their software firewall. Probably not the prettiest solution, but seems to work.

Reply | Quote

If you just want to hide them, you could disable NetBIOS on the Terminal server machine. Computer browsing is done via NetBIOS. Of course they would still be able to connect via IP address if they knew what it was.

Reply | Quote

Thanks! That’s a good idea. I went the firewall blocking route, and it seems to be working — however this is a more solid approach. Thanks!

Reply | Quote