Prior to ABE (Access-Based Enumeration), a user who had access to a share could see all the shares sub-folders, even if they didn't have permission to read the sub-folder.
If you enable ABE on a share, users who don't have permission to read a sub-folder will NOT be able to see the sub-folder when they enumerate the share.
NOTE: See Windows Server 2003 Access-based Enumeration tool. NOTE: If you have redirected user folders at \\ServerName\Users, you can hide the other user's folders by enabling ABE on the share:
shrflags \\ServerName\Users /abe true /forreal
When I type shrflgs /?, I receive:
ShrFlgs \\server\share \[switches\]
server Server to work with.
share Share name to work on. If '.' is specified, ShrFlgs
will enumerate all shares and display or update them.
Switches: (designated by - or /)
-forreal Really make changes.
-noadmin Don't display admin shares.
-abe (true|false) Set/clear access-based enumeration.
-afd (true|false) Set/clear allowed forced delete.
-nscache (true|false) Set/clear Namespace caching.
-exclopen (true|false) Set/clear allow exclusive open.
-csc xxx Set client side caching mode.
Valid values for xxx:
none - No offline caching
auto - All files opened by user will be cached.
manual - User selected files will be cached.
vdo - All files opened by user will be cached, optimized.
Note: Access-based enumeration requires at least Windows 2003 SP1.
You will not get an error on earlier OS'es if you try to set
ABE, it simply will not be set.
Display current settings for share sh1 on server
Display current settings for all shares on server
shrflags \\server\sh1 /abe true /forreal
Set access-based enumeration on share sh1 on server
shrflags \\server\. /abe true /forreal
Set access-based enumeration on all disk shares on server
shrflags \\server\sh1 /abe false /forreal
Set legacy enumeration on share sh1 on server
This software is Freeware. Use it as you wish at your own risk.
I do not warrant this software to be fit for any purpose or use and
I do not guarantee that it will not damage or destroy your system.
If you have improvement ideas, bugs, or just wish to say Hi, I
receive email 24x7 and read it in a semi-regular timeframe.
You can usually find me at firstname.lastname@example.org