Level 2 · Intermediate: networking & connectivity

2.5File & printer sharing, network access

Goal: Share files and printers while controlling who accesses them and at what level, according to the principle of least privilege.

Estimated time: 12 min · self-paced reading · If you only have 5 min: read “The essentials in 30s” + the diagram.

The essentials in 30 seconds

Sharing means making available AND controlling access: who can reach the resource, and at what level (read-only or read-write).
Least privilege: grant only the strict minimum; a folder open to everyone becomes an amplifier for a leak or ransomware.
Manage permissions by groups, not by person; folders and printers at a stable address (DHCP reservation) so they can always be found.

Running mini-case — Sofiane shares the HR folder without opening it to everyone

Sofiane, a support technician in a distribution SME in Algiers, must make the “HR” folder available on the file server. The temptation would be to open everything to avoid blockages; instead he applies least privilege. He sets the network to the private profile, then assigns permissions by group: the “HR” group as read/write, the “Managers” group as read-only, and no access for others. He also shares the department printer at a stable address (DHCP reservation) so it stays always reachable. Finally, he tests from an account of each group: the access obtained corresponds exactly to the intent — no more, no less.

Standalone case for this section: it returns in the lesson, the diagram, the script and the 48h challenge of section 2.5.

1. Sharing = making available AND controlling access

Once the machines are on the network, you want to share: a folder, a printer. Enabling a share is simple — and that is precisely the risk. Sharing is two skills: making the resource available, and controlling who can reach it and what they can do (read-only, or read-write).

2. Least privilege

The guiding principle is least privilege: grant each person only what they need, nothing more. A folder open to everyone is convenient today, and an amplifier for a leak or ransomware tomorrow. That is what Sofiane refuses: no “everything open” to go faster.

3. Managing by groups and sharing a printer

Permissions are assigned to groups (by role), not one by one: when someone arrives, changes workstation or leaves, you change their group membership — not hundreds of scattered entries. A network printer follows the same logic: shared for the right people, ideally at a stable address (DHCP reservation) so it can always be found.

Common misinterpretation: “To avoid blockages, the simplest is to open a folder to everyone; you assign user rights user by user for more finesse; and sharing a printer on a network in public profile has no consequence”. No, triple error. A share “open to everyone” turns a single mistake — or a ransomware — into a generalised incident: you apply least privilege. Managing by individual quickly becomes unmanageable and unauditable: you go through groups. And sharing on a network in public profile needlessly exposes the resource: you switch the profile to private (trusted). Sofiane then tests the actual access.

A group is linked to a precise permission on a resource — never “open to everyone”.

Text version of the diagram (SEO / screen readers / translation): 1) Sofiane, a support technician in a distribution SME in Algiers, learns that sharing means making a resource available AND controlling access: who can reach it and at what level (read-only or read-write). 2) He applies least privilege — granting only the strict minimum — because a folder open to everyone amplifies any leak or attack, and he manages permissions by groups rather than individual by individual. 3) For the “HR” folder, he assigns: the “HR” group as read/write, the “Managers” group as read-only, no access for others; he shares the printer at a stable address (DHCP reservation) and sets the network to the private profile. Lesson: controlling access is the real skill, and you always test the actual access afterwards.

🔎 Concrete example — 🔎 Concrete example — A well-shared HR folder

Objective: the HR department accesses the “HR” folder, no one else. Sofiane sets the rules:

Group “HR”        ->  read / write
Group “Managers”  ->  read only
Everyone else     ->  no access

Reading   : access granted by group and by level
Diagnosis : test from an account of each group

Reading: access is granted by group and by level, according to the real need (least privilege).

Lesson: then test from an account of each group that the access corresponds exactly to the intent — no more, no less.

Section vocabulary

Folder or printer made available to the other machines on the network.

Simple example: Sofiane shares the “HR” folder on the file server.

What it is not: a local file visible only on one's own workstation.

Reflex: make available → share.

Permissions

Rules deciding who accesses and at what level (read, or read/write).

Simple example: Sofiane gives read/write to the HR group, read-only to the Managers.

What it is not: the bandwidth allocated to each workstation.

Reflex: who and at what level → permissions.

Least privilege

Granting only the strictly necessary access, and nothing more.

Simple example: Sofiane does not open the HR folder to everyone.

What it is not: giving administrator rights to all users.

Reflex: the strict minimum → least privilege.

Group

Set of users receiving permissions together (by role).

Simple example: Sofiane manages access via the “HR” group, not user by user.

What it is not: a permission set for a single named person.

Reflex: by role → by group.

Network profile (private/public)

Setting that treats the network as trusted (private) or not (public), affecting sharing.

Simple example: Sofiane switches the network to the private profile before sharing.

What it is not: a share left active on a public network.

Reflex: share → private profile.

In practice — In practice — Sharing a folder safely

Enable sharing and set the network to the private profile (trusted), like Sofiane.
Share a folder: one group as read-only, another as read/write (least privilege).
Share a printer for the right people, at a stable address (DHCP reservation).
Test from another machine that the access corresponds exactly to the intent.

You share files and printers while controlling access by need.

Step-by-step script — sharing the HR folder like Sofiane (5 min)

1) Set the network to the private profile (trusted) and enable sharing. 2) Create or locate the groups: “HR”, “Managers”. 3) Assign: HR as read/write, Managers as read-only, no access for others. 4) Share the department printer at a stable address (DHCP reservation). 5) Test from an account of each group: the access must correspond exactly to the intent.

Managing by groups makes each arrival or departure simple: a single membership to change, and the whole stays auditable.

Copy-paste template — my sharing policy

Network profile : private (trusted)
Group “HR”        ->  read / write
Group “Managers”  ->  read only
Everyone else     ->  no access
Printer : stable address (DHCP reservation)
Rule : least privilege, by groups, then test the actual access

Confidential folder

Sofiane reserves the HR folder for the HR group as read/write, for the Managers as read-only.

Shared printer

Sofiane shares the printer at a stable address so it stays always reachable.

A new employee arrives

A single group membership to add, and the access is correct — without touching the permissions.

Always verify

Sofiane tests from an account of each group that the access is no more and no less than wanted.

✓ Best practices

Manage by groups, not by person.
Apply least privilege on each resource.
Test the actual access after setting the permissions.

✗ Common pitfalls

Leaving a folder “open to everyone”.
Setting permissions individually.
Sharing on a network in public profile.

Key takeaways

Sharing is easy; controlling access is the real skill.
Least privilege: access by need, read vs write.
Permissions by groups, not by individuals.
Network in private profile to share; always test the access obtained.

48h challenge — apply it tomorrow

Like Sofiane, define the policy for a shared folder: one group as read/write, one group as read-only, no access for others. Set the network to the private profile, then test from an account of each group that the access corresponds exactly to the intent. Note in one sentence why opening to everyone would be a risk.

Section exit checklist