Samba – Can group policy deny access to non-domain shares

group-policysambawindows-server-2008

I have a requirement to deploy a Samba share to facilitate file sharing between a DOS 6 non-domain computer and a Windows 7 workstation which is a member of a Win 2008 domain.

IT will not currently cooperate although they are not preventing me from attaching a device to the network either. So at home I set up a simulation on VirtualBox, with a domain consisting of Server 2008 and a Windows 7 client, and a workgroup with FreeDOS and Debian Jessie.

I had to enable LANMAN authentication in Samba to support the DOS box connecting. Now I have E: mapped on the DOS machine, and on the Windows 7 machine I can browse to \\jessie\share using explorer.

So really I am wondering if this will work in practice on site, or could the group policy of the domain prevent me from doing this?

Further details

The DOS box controls some industrial machinery and the operators would like to load the CAD files onto it over the network. Apparently IT were asked to set this up and failed, which is why they are reluctant to talk to me about it. Having looked at other sites it seems the way to go is to map a network share to a local drive letter and deposit the cad files there.

The DOS machine cannot access the existing network shares as it is not a domain member. I am not entirely sure if DOS 6 can join a Windows 2008 domain, but it certainly won't be possible without IT's consent. So I thought of using a neutral file share that would be accessible from both the domain and non-domain computers.

I intend to use a Raspberry PI for the job as this also addresses some space constraints by allowing us to install the PI in the same enclosure as the DOS box.

The workstation is on a /29 VLAN segment so adding two computers might create a shortage of IP addresses. However, I solved this in my simulation by creating a totally different range for the PI and the DOS machine to talk on hence not interfering with the existing IPv4 LAN in any way whatsoever. And the Windows 7 box can find the PI using IPv6 link local.

Best Answer

I'm not aware of any specific option to prevent mapping a drive from a non domain source, but there are ways to block mapping drives completely in group policy e.g. User Configuration\Administrative Templates\Windows Components\Windows Explorer. Remove "Map Network Drive" and "Disconnect Network Drive".