Allowing anonymous access to server resources

Hey OCF,

We have a client with Windows 2003 Server (sbs SP1). I want to figure out how to allow an anonymous user to print to one of the printers.

Even when i set the everyone group to be allowed access to the printer object, I still cannot connect to the server shares at all, through a non-domain account.

I don't know how this would affect CAL usage, as we are having problems with that atm. Tia.

Redwraith94

Not feasible. To get to the printer which is administered by your SBS Server you have to have a CAL. The CAL is required for any device or user which authenticates with the SBS box.

I don't think you would need a CAL for the printer if you had setup as per user licensing. Then each user has a CAL to access the server, no matter how many PCs or devices are used for that user.

Fair enough, but is it possible to do, assuming I had set per server mode, and had enough CAL to allow anyone to access server shares at all?

For instance, I can't even navigate to \\servername\, it prompts for a username password, which is what I want to avoid.

I don't want to use the net use command and have cleartext credentials flying across the wire.

I don't think there is a way to make //servername not require a password. It is setup to only allow access to the group Domain Users, not Everyone. You would need to have the Everyone group have access for that to work. The problem with that is then that anyone could connect and browse to the server easily.

How are the users connecting that are not a part of the domain? If you have just a public PC setup it should be easy enough to manully map the printer and enter the credentials of a domain account. If they are using laptops they bring then it isn't going to work.

For this one credit union, one user is a third party that comes in sort of an accountant, the other two are state auditors, so my problem is that we don't have access to their pc's (laptops) and they are in the conference room, so I would like to give them access to printers, and a couple of network shares.

I know we can create accounts for them, but the this has happened with a couple of other clients. It would be really handy to a way to designate a couple of network resources for use without requiring credentials. Like with XP's 'simple file sharing' where ppl authenticate as the guest account.