MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

LAB 4
CONFIGURING FILE
AND SHARE ACCESS

THIS LAB CONTAINS THE FOLLOWING EXERCISES AND ACTIVITIES:

Exercise 4.1 Sharing a Folder

Exercise 4.2 Testing Share Access

Exercise 4.3 Working with NTFS Permissions

Exercise 4.4 Creating Shares with Server Manager

Exercise 4.5 Creating Work Folders

Lab Challenge Creating Shares with Windows PowerShell

BEFORE YOU BEGIN

The lab environment consists of computers connected to a local area network, along
with a server that functions as the domain controller for a domain called adatum.com.
The computers required for this lab are listed in Table 4-1.

Table 4-1
Computers Required for Lab 4
Computer Operating System Computer Name
Domain controller Windows Server 2012 R2 SERVERA
Member server Windows Server 2012 R2 SERVERB
Member server with three Windows Server 2012 R2 SERVERC
additional SCSI hard drives
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

In addition to the computers, you also require the software listed in Table 4-2 to
complete Lab 4.

Table 4-2
Software Required for Lab 4
Software Location
Lab 4 student worksheet Lab04_worksheet.docx (provided by instructor)

Working with Lab Worksheets

Each lab in this manual requires that you answer questions, create screen shots, and
perform other activities that you will document in a worksheet named for the lab, such
as Lab04_worksheet.docx. It is recommended that you use a USB flash drive to store
your worksheets, so you can submit them to your instructor for review. As you
perform the exercises in each lab, open the appropriate worksheet file, fill in the
required information, and save the file to your flash drive.

After completing this lab, you will be able to:

 Share folders using File Explorer

 Share folders using Server Manager

 Configure share and NTFS permissions

 Create work folders

 Create shares with Windows PowerShell

Estimated lab time: 60 minutes

Exercise 4.1 Sharing a Folder

Overview In this exercise, you create a folder share using the File Explorer
interface.
Mindset How familiar are you with the traditional tools for creating and
managing shares?
Completion time 15 minutes

1. On the SERVERC computer, click the File Explorer icon on the taskbar. A File
Explorer window appears.

2. In File Explorer, select the E: drive and create a new folder called Accounting.

3. In the navigation pane, select the Accounting folder you just created. Then, right-
click anywhere in the contents pane and, from the context menu, select New >
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

Rich Text Document. Give the file the name Budget and double-click it to open
the file in WordPad.

4. Type your name in the file and close the WordPad window, saving the changes to
the file when prompted to do so.

5. Right-click the Accounting folder you created and, from the context menu, select
Properties. The Accounting Properties sheet appears.

6. Click the Sharing tab, and then click Advanced Sharing. The Advanced Sharing
dialog box appears.

7. Select the Share This Folder check box.

8. In the Share Name text box, change the default value (Accounting) to
Spreadsheets.

9. Click Permissions. The Permissions for Spreadsheets dialog box appears.

10. For the Everyone special identity, clear all check boxes in the Allow column.

11. Click Add. The Select Users, Computers, Service Accounts, or Groups dialog
box appears.

12. In the Enter the object names to select box, type Domain Admins and click OK
(log in with Administrator/Pa$$w0rd if necessary). The Domain Admins group
appears in the Group or user names list in the Permissions for Spreadsheets
dialog box.

What share permissions does a newly added group receive

Question by default?
1
Allow read permissions only

13. With the Domain Admins group highlighted, select the Full Control check box in
the Allow column, which selects the Change check box as well. Click Apply.

14. Using the same procedure, add the Domain Users group to the object names to
select list, and assign it the Allow Read permission only.

15. Take a screen shot of the Permissions For Spreadsheets dialog box by pressing
Alt+Prt Scr, and then paste the resulting image into the Lab 4 worksheet file in
the page provided by pressing Ctrl+V.
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

16. Click OK to close the Permissions for Spreadsheets dialog box.

17. Click OK to close the Advanced Sharing dialog box.

18. Click Close to close the Accounting Properties sheet.

End of exercise. Close any open windows before you begin the next exercise.

Exercise 4.2 Testing Share Access

Overview In this exercise, you demonstrate the use of share permissions to
limit access to file system shares.
Mindset What are the capabilities of share permissions, and what do you, as
an administrator, want to make use of them?
Completion time 15 minutes

1. On SERVERB, log on using the domain account Student with the password Pa$
$w0rd.

2. On SERVERB, click the Windows PowerShell button in the taskbar. The

Windows PowerShell window appears.

3. At the Windows PowerShell prompt, type explorer \\ServerC\Spreadsheets and

press Enter. A File Explorer window appears, displaying the contents of the share
you created in the previous exercise.

4. Double-click the Budget file to open it in WordPad.

MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

5. Add today’s date in the Budget file and click File > Save. A message box
appears, stating that access to the file is denied.

6. Click OK and close WordPad without saving.

Why are you unable to modify the Budget file?

Question
2
Student account only has the allow read permission

7. Log off the SERVERB server and log on again, but this time use the domain
Administrator account and the password Pa$$w0rd.

8. Using File Explorer, try again to open the Budget file by typing
\\SERVERC\Spreadsheets in the path field. Modify its contents, and then save it.

Why are you now able to modify the Budget file?

Question
3 The administrator account has the allow full control
permission

End of exercise. Close any open windows before you begin the next exercise.

Exercise 4.3 Working with NTFS Permissions

Overview In this exercise, you demonstrate the use of NTFS permissions in
combination with share permissions.

Mindset The use of share permissions and NTFS permissions together can be
confusing, especially when there are multiple administrators working
on the same servers. Permissions should, therefore, be dictated by a
company policy adhered to by everyone.
Completion time 15 minutes

1. On SERVERC, in File Explorer, right-click the Accounting folder you created in

Exercise 4.1 and, from the context menu, select Properties. The Accounting
Properties sheet appears.

2. Click the Security tab (see Figure 4-1).

MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

Figure 4-1
The Security tab of the Accounting Properties sheet

3. Click Edit. The Permissions for Accounting dialog box appears.

4. Click Add. The Select Users, Computers, Service Accounts, or Groups dialog
box appears.

5. In the Enter the object names to select text box, type Student and click OK. The
Student user appears in the Group or user names list in the Permissions for
Accounting dialog box.

For the purposes of this lab, you assign permissions directly

to the Student user account. How does this differ from
Question standard enterprise networking practice?
4
In the enterprise administrators assign NTFS permissions to
group, instead of the individual user accounts

6. Select the Student user and, in the Permissions for Student box, select the Allow
Full Control check box and click OK.

7. Click OK again to close the Accounting Properties sheet.

MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

8. On SERVERB, log on using the Student account and the password Pa$$w0rd.

9. Open the Run dialog box and, in the Open text box, type
\\ServerC\Spreadsheets and click OK. A File Explorer window appears,
displaying the contents of the share you created in Exercise 4.1.

10. Open the Budget file, delete the date you added earlier, and try to save your
changes. The system denies you access to the file.

Why are you unable to modify the Budget file, when you have
the Allow Full Control NTFS permission?
Question
5
It is because it was previously set as a share permission
which is limiting myself to modify the budget file

11. On SERVERC, log off and then log on again using the Student account and the
password Pa$$w0rd.

12. Open File Explorer, browse to the Accounting folder on the E: drive and, as
before, try to edit the budget file and save your changes.

Why are you able to modify the Budget file on this computer,
when you were unable to modify it on the other computer?
Question
6
Because the share permissions don’t apply when accessing
the file on the local drive

13. Typical enterprise sharing guidelines call for all access control to be performed
using NTFS permissions, not share permissions. On SERVERC, log off and then
log on as adatum\administrator with the Pa$$w0rd password. Modify the share
and the NTFS permissions for the Accounting folder you created, to conform to
the settings shown in the following table.

User/Group Share Permissions NTFS Permissions

Student Allow Full Control  Allow Modify
 Allow Read & Execute
 Allow List Folder Contents
 Allow Read
 Allow Write
Domain Users Allow Full Control  Allow Read & Execute
 Allow List Folder Contents
 Allow Read
Domain Admins Allow Full Control  Allow Full Control
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

14. Take a screen shot of the Security tab on the Accounting Properties sheet,
showing the NTFS permissions assigned to the Student user, by pressing Alt+Prt
Scr, and then paste the resulting image into the Lab 4 worksheet file in the page
provided by pressing Ctrl+V

End of exercise. Close any open windows before you begin the next exercise.

Exercise 4.4 Creating Shares with Server Manager

Overview In Windows Server 2012 R2, you can create shares directly within
the Server Manager console, once you have installed the File and
iSCSI Services role service. In this exercise, you install that role
service and create a new share.
Windows Server 2012 R2 is all about providing administrators with
Mindset new ways to perform familiar tasks. Which method for creating
shares do you find preferable?
Completion time 15 minutes

1. On SERVERC, in Server Manager, click File and Storage Services > Shares.
The Shares home page appears (see Figure 4-2).
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

Figure 4-2
The File and Storage Services submenu after the installation of File and iSCSI Services

2. In the Shares tile, click Tasks > New Share. The New Share Wizard appears,
displaying the Select the profile for this share page.

3. In the File share profile list, select SMB Share – Quick and click Next. The
Select the server and path for this share page appears.

4. In the Share location box, select the F: volume and click Next (if the F: share
does not exist, please use the E: share instead). The Specify share name page
appears.

5. In the Share name text box, type Documents and click Next. The Configure
share settings page appears.

6. Select the Enable access-based enumeration check box and click Next. The
Specify permissions to control access page appears.

7. Click Next to accept the default permissions. The Confirm selections page
appears.

What access will the Student user have to the Documents

share you are creating? How will the users receive that
access?
Question
7
The student account will read as well as execute files on the
share, because the account is the member of the domain
user group
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

8. Click Create. The wizard creates the share and the View results page appears.

9. Click Close. The Documents share appears in the Shares tile.

10. Take a screen shot of the Shares home page in Server Manager, showing the two
shares you created in this lab, by pressing Alt+Prt Scr, and then paste the
resulting image into the Lab 4 worksheet file in the page provided by pressing
Ctrl+V.

End of exercise. Close any open windows before you begin the next exercise.

Exercise 4.5 Creating Work Folders

Overview In Windows Server 2012 R2, Work Folders enable users to store
their files on a server and easily access them using any type of
connected device.
Windows Server 2012 R2 is all about providing administrators with
Mindset new ways to perform familiar tasks. Which method for creating
shares do you find preferable?
Completion time 15 minutes
1. On SERVERC, in Server Manager, click Manage > Add Roles and Features. The
Add Roles and Features Wizard appears, displaying the Before you begin page.

2. Click Next. The Select installation type page appears.

3. Click Next. The Select destination server page appears.

4. Click Next. The Select server roles page appears.

5. Expand the File and Storage Services role, expand File and iSCSI Services, and
then select the Work Folders check box. The Add features that are required for
Work Folders page appears.
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

6. Click Add Features.

7. Click Next. The Select features page appears.

8. Click Next. The Confirm installation selections page appears.

9. Click Install. The wizard installs the role service.

10. Click Close. The wizard closes.

11. In Server Manager, in the File and Storage Services submenu, click Work
Folders. The Work Folders home page appears.

12. In the Tasks list, click New Sync Share. The New Sync Share Wizard appears.

13. Click Next. The Select the server and path page appears, as shown in Figure 4-3

Figure 4-3
The Select Server and Path page in the New Sync Share Wizard

14. Click the Select by file share option, select the Spreadsheets share you created in
Exercise 4.1, and then click Next. The Specify the structure for user folders page
appears.
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

15. Click Next to accept the default settings. The Enter the sync share name page
appears.

16. In the Name text box, type Sheets and then click Next. The Grant sync access to
groups page appears.

17. Click Add. The Select User or Group dialog box appears.

18. In the Enter the object name to select box, type Domain Users and then click OK.

19. Click Next. The Specify device policies page appears.

20. Clear the Automatically lock screen and require a password checkbox and then
click Next. The Confirm selections page appears.

21. Click Create. The wizard creates the sync share.

22. Click Close. The new sync share appears on the Work Folders page.

End of exercise. Close any open windows before you begin the next exercise.

Lab
Challenge Creating Shares with Windows PowerShell
Overview In addition to the graphical tools provided with Windows Server
2012 R2, you can also manipulate the storage subsystem using
Windows PowerShell commands.
Completion time 15 minutes

To complete this challenge, specify the Windows PowerShell command you must use
to create a new share called Xfer out of the Users folder on the C: drive. Configure the
share permissions so that members of the Domain Admins group have Full Access and
the members of the Domain Users group have Read access.

New-SmbShare-Name Xfer -Path c:\Users -FullAccess “adatum\Domain Admins”

-ReadAccess “adatum \Domain User”
MOAC 70-410 - Installing and Configuring Windows Server 2012 R2 Lab Manual

End of lab. You can log off or start a different lab. If you want to restart this lab,
you’ll need to click the End Lab button in order for the lab to be reset.