On my setup, I have a file server with a RAID that generally is a bare (but SP’d and updated) Win2003 server install, ie a very minimal installation. At one point I set up ADS with a domain, DNS, etc. Nowadays, I still setup the DNS server on this box, but generally don’t make use of ADS, in my (albeit weak) attempt at simplification.
On my workstations, I install Win2000/XP/Vista in Workgroup mode and use identical passwords and user accounts on the server and each workstation. That way, legacy login support kicks in and login validations still apply, but I don’t have to mess with ADS and domains to make it happen. Not as secure as ADS, but not completely open either.
One thing I tend to do, when possible, is install apps to a network drive and run them from there. I say when possible because for those apps that require COM registration, etc, this doesn’t work too well. But there are plenty of apps that work just fine this way, including Trillian, Keepass, InfoSelect, NotePad++, IrfanView, etc. Keeps me from having to reinstall and redo configuration.
With the latest install of Vista, however, I was getting a “Are you sure” dialog like this every time I went to run an app off a server share.
Now, before people start screaming “Good Lord, don’t turn that off, there’s no telling what might have replaced that app out on the network! How do you know it’s safe?!”, the fact is that my entire network runs behind a firewall, and all machines run NOD32. If something infected an app out on the server share, it’s just as likely to have already infected my local workstation anyway.
I’d rather not have to “accept” running any app off the server every time I want to, so what I needed was a way to tell Windows, “Hey, it’s OK to run files from these locations, I’m fairly certain they’re safe”.
Come to find out, such a setting exists, of all places, in the Internet Settings area of the Control Panel:
Make sure the Local Intranet security is medium-low or lower. This is the default though, and doesn’t appear to need to be changed.
At this point, just enter the UNC of your server, say \\MyServer (you only need to enter the root server name, unless you specifically don’t trust certain shares on your server, in which case you could specify the server and share name, such as \\MyServer\MyTrustedShare.
And that’s it.
If there are any significant security issues with this approach, I’m not seeing them. I have to trust my server as much as my workstations (if not more, since I rarely actually install any software on my server. Anybody care to enlighten me?