This topic describes how to use the Windows access control feature of Cloud Storage Gateway to enable access-based enumeration.
Prerequisites
You have created an SMB share and enabled Windows access-based enumeration. For more information, see Enable Windows permission support.
You have created a Windows-based ECS instance to serve as the client. The ECS instance and CSG instance are deployed in the same VPC network. For more information, see Create an ECS instance.
You have created the following domain users on the domain controller: Administrator, user1, and user2.
Background information
In a Windows file system, files and folders are visible to users by default, even if the users do not have permission to perform operations on them. After you enable the Windows access control feature for a Cloud Storage Gateway, you can enable access-based enumeration for the shared folder that is mounted to the client. This ensures that users can see only the files and folders for which they have access permissions.
In this topic, the ECS instance runs the Windows Server 2012 R2 Datacenter Edition operating system.
Add user permissions
Select the region where the destination file gateway is located. On the Gateway List page, find and click the destination file gateway.
Click the Shares tab. In the Actions column of the destination SMB share, click Settings.
In the SMB Share Settings dialog box, add Administrator, user1, and user2 to the Read/Write Users list.
Click Confirm.
Mount the shared folder and set folder permissions
Log on to the Windows ECS instance that you created.
Select a drive, enter the mount target of the Cloud Storage Gateway in the Folder box, and then click Finish.
You can find the destination Cloud Storage Gateway in the Cloud Storage Gateway console and view its mount target on the Shares tab.
In the Windows Security dialog box, enter the username and password for Administrator, and then click OK.
When you enter the username, you must add the Active Directory (AD) domain name. The format is: <AD domain name>\Administrator.
Go to the mounted shared folder and create two new folders: user1 and user2.
Right-click the user1 folder, click Properties, and then click the Security tab.
Follow these steps to set permissions for the user1 folder so that only Administrator and user1 have permission to perform operations on the folder.
Click Advanced. On the Permissions tab, click Disable inheritance. Then, remove the permissions for Everyone and Domain Users. Click Apply and then OK.
Click Edit. In the permissions dialog box, click Add, enter user1, and then click Check Names.
In the Windows Security dialog box, enter the username and password for user1, and then click OK.
When you enter the username, you must add the AD domain name. The format is: <AD domain name>\user1.
Use the method in Step 7 to set permissions for the user2 folder so that only Administrator and user2 have permission to perform operations on the folder.
Verify the Windows access control feature
In This PC, right-click the mounted shared folder and click Disconnect.
After the page is refreshed, follow Step 2 and Step 3 in Mount the shared folder and set folder permissions to mount the shared folder again.
Connect to the mounted shared folder as user1, user2, and Administrator in turn.
The results are as follows:
user1 can see only the user1 folder.
user2 can see only the user2 folder.
Administrator can see both the user1 and user2 folders.
You have now enabled access-based enumeration for the shared folder using the Windows access control feature of Cloud Storage Gateway.