Have you ever had one of those moments in IT, when you discover a tool, and a light bulb goes on inside your head, and you say to yourself “I’ve needed this for ages! This really fixes issue X”?
I’ve had that a few times (maybe I need to get out more?), and one of those times was a few years ago with a tool from Microsoft, named as only MS can: Windows Server 2003 Access Based Enumeration or ABE. I took it for granted that everyone knew about this great tool, and was using it. That was until I suggested to a client that it may help his corporate share restructering project, and he looked at me blankly. In fact the more people I’ve mentioned this to, the more blank looks I’ve got. So, if you’ve not heard of it you’re probably asking what the damned thing does?
ABE, is a very small download from Microsoft, that provides a piece of functionality everyone has been wishing for since, well NT4 in my case. Basically when you have a user connect to a shared folder, and they are browsing within that folder structure, if they don’t have permission to a folder/file then they just don’t see it. Gone are the previous issues of getting access denied messages, followed by helpdesk calls to clarify if they should be allowed in to Folder Y. Great huh?
As part of installing ABEUI.msiyou have the following options:
Post installation changes can be made through CLI using abecmd.exe or through a tab on the share’s property dialog:
Acess Based Enumeration requires Windows Server 2003 with Service Pack 1. It’s not required on Windows Server 2008, because the behaviour is already included, but is not configurable. Finally ;)