Chapter 5 File and Printer Services MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410 MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410 Chapter 5 File and Printer Services Chapter 5 File and Printer Services

Objectives Describe how Windows implements file and print sharing Secure access to files with permissions Create file shares Describe Work Folders Configure and manage Windows printing Objectives Describe how Windows implements file and print sharing Secure access to files with permissions Create file shares Describe Work Folders Configure and manage Windows printing MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

An Overview of File and Printer Sharing File and print sharing functions are in the File and Storage Services role Windows clients access shared files and printers by using Server Message Block (SMB) SMB is a client/server Application-layer protocol that provides network file sharing, network printing, and authentication A common variation of SMB is Common Internet File System (CIFS) An Overview of File and Printer Sharing File and print sharing functions are in the File and Storage Services role Windows clients access shared files and printers by using Server Message Block (SMB) SMB is a client/server Application-layer protocol that provides network file sharing, network printing, and authentication A common variation of SMB is Common Internet File System (CIFS) MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

An Overview of File and Printer Sharing Windows Server 2012/R2 also supports Network File System (NFS) NFS is the native sharing protocol in UNIX and Linux OSs Server for NFS is a role service found under File and Storage Services Need to be installed in order to support clients using the NFS protocol Windows shares printers using SMB protocol but also supports other protocols, such as: LPR/LPD and Internet Printing Protocol (IPP) An Overview of File and Printer Sharing Windows Server 2012/R2 also supports Network File System (NFS) NFS is the native sharing protocol in UNIX and Linux OSs Server for NFS is a role service found under File and Storage Services Need to be installed in order to support clients using the NFS protocol Windows shares printers using SMB protocol but also supports other protocols, such as: LPR/LPD and Internet Printing Protocol (IPP) MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Securing Access to Files with Permissions Two ways to secure files Share permissions NTFS permissions Permissions - specify which users can access a file system object and what users can do with that object Share permissions apply when using a network to access shared files NTFS permissions always apply whether accessing network shares or local files Securing Access to Files with Permissions Two ways to secure files Share permissions NTFS permissions Permissions - specify which users can access a file system object and what users can do with that object Share permissions apply when using a network to access shared files NTFS permissions always apply whether accessing network shares or local files MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Security Principals Three types of objects (security principals) can be assigned permission to access the file system: Users, groups, and computers An object’s security settings have three components that make up its security descriptor: Discretionary access control lists Object owner System access control list Security Principals Three types of objects (security principals) can be assigned permission to access the file system: Users, groups, and computers An object’s security settings have three components that make up its security descriptor: Discretionary access control lists Object owner System access control list MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Security Principals Discretionary access control list (DACL) - a list of security principals; each has permissions that define access to an object Access control entry (ACE) - an entry in a discretionary access control list Object owner - usually the user account that created the object or a group or user who has been assigned ownership of the object System access control list (SACL) - a file system component that defines the settings for auditing access to an object Security Principals Discretionary access control list (DACL) - a list of security principals; each has permissions that define access to an object Access control entry (ACE) - an entry in a discretionary access control list Object owner - usually the user account that created the object or a group or user who has been assigned ownership of the object System access control list (SACL) - a file system component that defines the settings for auditing access to an object MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

How Permissions Are Assigned Users can be assigned permission to an object in four ways: The user creates the object The user’s account is added to the object’s DACL This method is called explicit permission A group the user belongs to is added to the object’s DACL Also considered explicit permission Permission is inherited from the DACL of a parent object the user or group account has been added to This method is called inherited permission How Permissions Are Assigned Users can be assigned permission to an object in four ways: The user creates the object The user’s account is added to the object’s DACL This method is called explicit permission A group the user belongs to is added to the object’s DACL Also considered explicit permission Permission is inherited from the DACL of a parent object the user or group account has been added to This method is called inherited permission MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Share Permissions Share permissions apply to folders and files accessed across the network Can’t be configured on individual files Three share permissions Read Change Full Control Generally, the default share permission is Read for Everyone Share Permissions Share permissions apply to folders and files accessed across the network Can’t be configured on individual files Three share permissions Read Change Full Control Generally, the default share permission is Read for Everyone MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

NTFS Permissions NTFS permissions can be configured on folders and files Folders have 6 permissions and 14 special permissions Files have 5 permissions and 13 special permissions NTFS standard permissions: Read Read & Execute List folder contents Write Modify Full NTFS Permissions NTFS permissions can be configured on folders and files Folders have 6 permissions and 14 special permissions Files have 5 permissions and 13 special permissions NTFS standard permissions: Read Read & Execute List folder contents Write Modify Full MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Table 5-2 NTFS special permissions MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

File and Folder Ownership Every file system object (files and folders) has an owner An object owner is granted certain implicit permissions A user can become the owner of a file system object in three ways: Create the file or folder Take ownership of a file or folder Assigned ownership File and Folder Ownership Every file system object (files and folders) has an owner An object owner is granted certain implicit permissions A user can become the owner of a file system object in three ways: Create the file or folder Take ownership of a file or folder Assigned ownership MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

NTFS Permission Inheritance By default, initial permissions are set at the root of a volume All folders and files in the volume inherit these settings unless configured otherwise Subfolders and files are configured to inherit permission by default Permission inheritance can be disabled, if needed To disable permission inheritance, open the Advanced Security Settings dialog box for an object and click the Disable inheritance button NTFS Permission Inheritance By default, initial permissions are set at the root of a volume All folders and files in the volume inherit these settings unless configured otherwise Subfolders and files are configured to inherit permission by default Permission inheritance can be disabled, if needed To disable permission inheritance, open the Advanced Security Settings dialog box for an object and click the Disable inheritance button MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Figure 5-4 The Advanced Security Settings dialog box MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Effective Access Effective access - the access a security principal has to a file system object when taking sharing permissions, NTFS permissions, and group memberships into account The Advanced Security Settings dialog box has an Effective Access tab You can select a user or group to see its access to a file or file or folder Effective Access Effective access - the access a security principal has to a file system object when taking sharing permissions, NTFS permissions, and group memberships into account The Advanced Security Settings dialog box has an Effective Access tab You can select a user or group to see its access to a file or file or folder MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Figure 5-5 The Effective Access tab MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Copying and Moving Files and Folders Rules to keep in mind when copying or moving files and folders within or between volumes: A file or folder copied within the same NTFS volume or to a different NTFS volume inherits permissions from the destination folder A file or folder moved within the same NTFS volume retains its original permissions A file or folder moved to a different NTFS volume inherits the destination folder’s permissions Copying and Moving Files and Folders Rules to keep in mind when copying or moving files and folders within or between volumes: A file or folder copied within the same NTFS volume or to a different NTFS volume inherits permissions from the destination folder A file or folder moved within the same NTFS volume retains its original permissions A file or folder moved to a different NTFS volume inherits the destination folder’s permissions MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Copying and Moving Files and Folders Rules to keep in mind when copying or moving files and folders within or between volumes (cont’d): A file or folder moved from a FAT or FAT32 volume to an NTFS volume inherits the destination folder’s permissions A file or folder moved or copied from an NTFS volume to a FAT or FAT32 volume loses all permission settings because FAT/FAT32 volumes don’t support permissions Copying and Moving Files and Folders Rules to keep in mind when copying or moving files and folders within or between volumes (cont’d): A file or folder moved from a FAT or FAT32 volume to an NTFS volume inherits the destination folder’s permissions A file or folder moved or copied from an NTFS volume to a FAT or FAT32 volume loses all permission settings because FAT/FAT32 volumes don’t support permissions MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Creating Windows File Shares Folders in Windows Server 2012/R2 can be shared only by members of the Administrators or Server Operators groups Methods to configure folder sharing: Simple file sharing Advanced Sharing dialog box Shared Folders snap-in File and Storage Services Share and Storage Management Creating Windows File Shares Folders in Windows Server 2012/R2 can be shared only by members of the Administrators or Server Operators groups Methods to configure folder sharing: Simple file sharing Advanced Sharing dialog box Shared Folders snap-in File and Storage Services Share and Storage Management MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Using Deny in an ACE The Deny permission should be used cautiously and only for exceptions As a rule, a Deny permission overrides an Allow permission Exception: If the Deny permission is inherited from a parent object, and the Allow permission is explicitly added to the object’s DACL The Allow permission takes precedence Using Deny in an ACE The Deny permission should be used cautiously and only for exceptions As a rule, a Deny permission overrides an Allow permission Exception: If the Deny permission is inherited from a parent object, and the Allow permission is explicitly added to the object’s DACL The Allow permission takes precedence MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Creating Shares with File and Storage Services Create shares and set a number of sharing options with the New Share Wizard In the File and Storage Service role 5 options for setting the share profile: SMB Share - Quick SMB Share - Advanced SMB Share - Applications NFS Share - Quick NFS Share - Advanced Creating Shares with File and Storage Services Create shares and set a number of sharing options with the New Share Wizard In the File and Storage Service role 5 options for setting the share profile: SMB Share - Quick SMB Share - Advanced SMB Share - Applications NFS Share - Quick NFS Share - Advanced MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Creating Shares with File and Storage Services You can set the following additional options for an SMB share: Enable access-based enumeration - shows only the files and folders to which a user has at least Read permission Allow caching of share - enables or disables offline files (also known as “client-side caching” Encrypt data access - retrieving files from the share is encrypted to prevent someone from using a network sniffer to view the contents of files as they are transferred across the network Creating Shares with File and Storage Services You can set the following additional options for an SMB share: Enable access-based enumeration - shows only the files and folders to which a user has at least Read permission Allow caching of share - enables or disables offline files (also known as “client-side caching” Encrypt data access - retrieving files from the share is encrypted to prevent someone from using a network sniffer to view the contents of files as they are transferred across the network MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Default and Administrative Shares Administrative shares - hidden shares created by Windows that are available only to members of the Administrators group: Admin$ - provides network access to the Windows folder on the boot volume Drive$ - drive represents the drive letter of a disk volume (example: C$) IPC$ - IPC means interprocess communications Domain controller have all of the above, plus: NETLOGON - used for storing default user profies SYSVOL - used by Active Directory for replication Default and Administrative Shares Administrative shares - hidden shares created by Windows that are available only to members of the Administrators group: Admin$ - provides network access to the Windows folder on the boot volume Drive$ - drive represents the drive letter of a disk volume (example: C$) IPC$ - IPC means interprocess communications Domain controller have all of the above, plus: NETLOGON - used for storing default user profies SYSVOL - used by Active Directory for replication MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Managing Shares with the Shared Folders Snap-in Use the Shared Folders snap-in to: Create, delete, and monitor shares View open files Monitor and manage user connections or sessions The Shared Folders snap-in has the following subnodes: Shares - view all shares, their path, and how many clients are connected to each share Sessions - lists users who have a network connection to the server Open Files - lists files that network users have open Managing Shares with the Shared Folders Snap-in Use the Shared Folders snap-in to: Create, delete, and monitor shares View open files Monitor and manage user connections or sessions The Shared Folders snap-in has the following subnodes: Shares - view all shares, their path, and how many clients are connected to each share Sessions - lists users who have a network connection to the server Open Files - lists files that network users have open MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Accessing File Shares from Client Computers For shared resources to be useful, users must know how to access them Common methods of accessing shared folders: UNC path Active Directory search Mapping a drive Browsing the network Accessing File Shares from Client Computers For shared resources to be useful, users must know how to access them Common methods of accessing shared folders: UNC path Active Directory search Mapping a drive Browsing the network MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Figure 5-16 Browsing the network in Windows 8.1 MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Windows Printing Components of a shared printer: Print device - physical print device, two basic types: Local print device Network print device Printer - the icon in the Printers folder that represents print devices Print Server - a Windows computer that’s sharing a printer Print queue - a storage location for print jobs awaiting printing Windows Printing Components of a shared printer: Print device - physical print device, two basic types: Local print device Network print device Printer - the icon in the Printers folder that represents print devices Print Server - a Windows computer that’s sharing a printer Print queue - a storage location for print jobs awaiting printing MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Print Servers Windows Server 2012/R2 print server functions: Access Control - control who can print to a printer and who can manage print jobs and printers Printer pooling - a single printer represents two or more print devices Printer Priority - two or more printers can represent a single print device Print job Management - pause, cancel, restart, reorder, and change preferences on print jobs Availability control - configure print servers so that print jobs are accepted only during certain hours Print Servers Windows Server 2012/R2 print server functions: Access Control - control who can print to a printer and who can manage print jobs and printers Printer pooling - a single printer represents two or more print devices Printer Priority - two or more printers can represent a single print device Print job Management - pause, cancel, restart, reorder, and change preferences on print jobs Availability control - configure print servers so that print jobs are accepted only during certain hours MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Print Servers Printer Pooling - a single printer is defined on the print server The printer is connected to two or more print devices on separate ports Print jobs are sent to the print device that is least busy Printer Priority - Printer can be assigned different priorities so that jobs sent to the higher priority printer are sent to the print device first Print Servers Printer Pooling - a single printer is defined on the print server The printer is connected to two or more print devices on separate ports Print jobs are sent to the print device that is least busy Printer Priority - Printer can be assigned different priorities so that jobs sent to the higher priority printer are sent to the print device first MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Configuring a Print Server To configure a Windows Server 2012/R2 system as a print server you need to share a printer The Sharing tab in a printer’s Properties dialog box provides the following options: Share this printer Share name Render print jobs on client computers List in the directory Additional Drivers Configuring a Print Server To configure a Windows Server 2012/R2 system as a print server you need to share a printer The Sharing tab in a printer’s Properties dialog box provides the following options: Share this printer Share name Render print jobs on client computers List in the directory Additional Drivers MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Configuring a Print Server The Advanced tab of a print server’s Properties dialog box provides more options for controlling the print server: Always available / Available from Priority Driver Spooling options Hold mismatched documents Print spooled documents first Keep printed documents Enable advanced printing features Printing Defaults Print Processor Separator Page Configuring a Print Server The Advanced tab of a print server’s Properties dialog box provides more options for controlling the print server: Always available / Available from Priority Driver Spooling options Hold mismatched documents Print spooled documents first Keep printed documents Enable advanced printing features Printing Defaults Print Processor Separator Page MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Figure 5-31 The Advanced tab in a printer’s Properties dialog box MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Printer Permissions Access to printers is controlled much like access to folders and files No permission inheritance for printers Three standard permissions: Print Manage printers Manage documents In addition, there are 6 special permissions Printer Permissions Access to printers is controlled much like access to folders and files No permission inheritance for printers Three standard permissions: Print Manage printers Manage documents In addition, there are 6 special permissions MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Managing Print Documents Manage each document in the print queue by right-clicking the document You can take the following actions on a document: Pause Resume Restart Cancel Properties Managing Print Documents Manage each document in the print queue by right-clicking the document You can take the following actions on a document: Pause Resume Restart Cancel Properties MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Solving Print Queue Problems Common printing problem: print jobs stuck in the print queue Solution: cancel or restart the print job If the above solution does not work: cancel the job that’s trying to print and do one of the following: Open the Services control panel and restart the Print Spooler service Enter net stop “print spooler” and then enter net start “print spooler” at the command prompt Enter Stop-Service Spooler and then enter Start-Service Spooler at the command prompt Solving Print Queue Problems Common printing problem: print jobs stuck in the print queue Solution: cancel or restart the print job If the above solution does not work: cancel the job that’s trying to print and do one of the following: Open the Services control panel and restart the Print Spooler service Enter net stop “print spooler” and then enter net start “print spooler” at the command prompt Enter Stop-Service Spooler and then enter Start-Service Spooler at the command prompt MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Summary File and print sharing functions are in the File and Storage Services role There are two types of permissions to restrict access to files and folders: share and NTFS Three types of objects can be assigned permission to access the file system: users, groups, and computers Permissions are assigned in four ways: user creates an object, the user account is added to the DACL, a group the user belongs to is added to the DACL, and permission is inherited The File Server role service is required to share folders Summary File and print sharing functions are in the File and Storage Services role There are two types of permissions to restrict access to files and folders: share and NTFS Three types of objects can be assigned permission to access the file system: users, groups, and computers Permissions are assigned in four ways: user creates an object, the user account is added to the DACL, a group the user belongs to is added to the DACL, and permission is inherited The File Server role service is required to share folders MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Summary You should use Deny permission only when you need to create an exception to an Allow permission Client computers access shared folders: using the UNC path, through and Active Directory search, mapping a drive, and browsing the network Disk quotas are used to restrict how much space a user’s files can occupy on a server Shadow copies are enabled on an entire volume and allows users to access previous versions of files Work Folders is a role service that allows users to synchronize documents between company file servers and mobile devices Summary You should use Deny permission only when you need to create an exception to an Allow permission Client computers access shared folders: using the UNC path, through and Active Directory search, mapping a drive, and browsing the network Disk quotas are used to restrict how much space a user’s files can occupy on a server Shadow copies are enabled on an entire volume and allows users to access previous versions of files Work Folders is a role service that allows users to synchronize documents between company file servers and mobile devices MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410

Summary Windows Server 2012/R2 offers advanced features for managing shared printers and making printing easy and convenient for users The Print and Document Services role includes the Print Management snap-in, which can be used to managed multiple printers and print servers Summary Windows Server 2012/R2 offers advanced features for managing shared printers and making printing easy and convenient for users The Print and Document Services role includes the Print Management snap-in, which can be used to managed multiple printers and print servers MCSA Guide to Installing and Configuring Windows Server 2012/R2, Exam 70-410