Otdfbt

Looking for a Windows based solution.

Background:

1. A standalone WS 2012R2 located on NETWORK A is sharing a folder with R/W access through a local user.


2. A segregated NETWORK B contains user PCs, some joined to NETWORK B’s WS 2019 AD, others configured as standalone.


3. NETWORKS A and B are connected via a firewall/router appliance.

Requirements:

1. Make the share on the 2012R2 server in NETWORK A available as READ-ONLY to user PCs on NETWORK B.


2. Both domain-joined and standalone user PCs on NETWORK B need to have access to the share.


3. Guarantee that users’ access is READ-ONLY.


4. Users need to be able to launch applications directly from the READ-ONLY share/mapped drive.

Constraints:

1. No changes can be made to the Windows 2012R2 server.


2. Users should not be able to bypass the RO control and map the share as RW.

Discussion:

Basically we need to either re-share the WS 2012R2 share inside NETWORK B but this time as READ-ONLY, or somehow configure user PCs to map the RW share RO. However, since some user PCs are not domain-joined, we can’t simply let them “see” the external share (requirement 3).

Temporary solution:

A Linux machine CIFS-mounts the WS2012R2 share and exports it as RO using samba. This works, but introduces another platform which is not desirable. Also, it is somewhat slower than a true Windows solution, and reparse points get “lost”.

Attempted so far:

1. SMB sharing the SMB share


2. mklink /d the share and then exporting the link


3. SUBST command


4. Various chains of the above 3


5. DFS namespaces


6. FTP sharing the SMB share (does not work well as a true map)


7. NFS sharing the SMB share (windows keeps dereferencing all the way to the network path, resulting in failure)


8. Share between a Hyper-V host and a VM


9. Building SAMBA on Windows. Got quite far, but still unable to complete the build. Even if it builds, not hopeful that it will work correctly on Windows (unsupported)


10. Proxying the requests via a router. No luck so far.

The logical way to do it is as your Windows 2012R2 as it's in a workgroup, I would create another local user locally onto that server that is RO. but that break that;

Constraints:

No changes can be made to the Windows 2012R2 server.

Another solution is using another server and sync with DFS, but that 2012R2 would need to be domain joined to have it work. You state it break your rule #3, but it's not true, as you can put the security into the share for both users, one read only and the other RW, that part work, and your PC in a workgroups can have a manually mapped drive using the correct user account to map it.

1. Ensure Network B PCs have no network access to the current 2012 R2 file server (appropriate firewall rule or switch ACL)


2. Setup a robocopy job from the 2012 R2 file server to a new file server (with the /MIR option)


3. Create a RO share on the new file server from which a read-only copy of the data can be.