2.5File & printer sharing, network access
Once machines are networked, people want to share: a common folder, a network printer, a scanner. Sharing is simple to switch on — and that is exactly the risk. The guiding principle is least privilege: give each person access only to what they need, no more. A shared folder open to everyone is convenient today and a data-leak or ransomware amplifier tomorrow. So sharing is really two skills: making the resource available, and controlling who can reach it and what they can do (read only, or read and write).
In practice, you enable file and printer sharing, set the network to a trusted (private) profile rather than public, name machines clearly so they are findable, and then attach permissions to each share: which users or groups, and which level of access. Managing access by groups rather than person-by-person keeps it maintainable as people join and leave. Network printers follow the same logic — shared so the right people can print, ideally with a stable address so they are always found. The mindset here carries straight into the next level's account and permission management: convenience must never override the question « who should actually be able to touch this? »
Section vocabulary
- Share
- A folder or printer made available to other machines on the network.
- Permissions
- The rules that decide who can access a share and at what level (read, or read/write).
- Least privilege
- Granting only the access each person genuinely needs, and no more.
- Network profile (private/public)
- Windows setting that treats a network as trusted (private) or untrusted (public), affecting sharing.
- Group-based access
- Assigning permissions to groups rather than individuals, so access stays maintainable.
How do you properly secure a network share?
In practice — Share a folder safely
- Enable file and printer sharing and set the network to the private (trusted) profile.
- Share a folder and grant one group read-only and another read/write, applying least privilege.
- Share a printer so the right people can print, ideally at a stable address.
- Test from another machine that access matches exactly what you intended — no more, no less.
Key takeaways
- Sharing is easy; controlling access is the real skill — apply least privilege.
- Attach permissions to each share: which users/groups, and read vs read/write.
- Manage access by groups, not person-by-person, so it stays maintainable.
- Set the network to private (trusted) for sharing, and always test that access matches intent.
Frequently asked questions
Why not just share everything with everyone — it is so much simpler?
Because « open to everyone » is the single most common cause of avoidable data incidents. If any account can read and change any file, then a single compromised account, an honest mistake, or a piece of ransomware can reach and damage everything at once. Least privilege contains that blast radius: people touch only what their job needs, so a problem stays local. It also protects confidentiality — not every file should be visible to every employee. The small upfront effort of granting access by need, managed through groups, is far cheaper than the cleanup after an over-shared folder is leaked, deleted or encrypted.
Should permissions be set on individual users or on groups?
Almost always on groups. If you grant access user by user, then every hire, departure or role change becomes a hunt through countless individual permissions, and things drift out of sync. With group-based access, you grant the group the right level once, and managing a person becomes as simple as adding or removing them from the right group. This scales, stays auditable (you can see who is in which group), and reduces mistakes. It is the same philosophy that underpins directory-based administration in the next level: manage the pattern, not each exception.