preventing users from seeing entire network

Hello!
Hope somebody can help me out.
I've just setup a basic network. Single 2003 server domain controller, with
10 machines attached to it. I've got control over DHCP,DNS, everything...no
wins running
Point is, im trying to prevent users from seeing things through entire
network (seeing other clients, servers) etc. I do not want to go to every
computer and disable netbios over tcp, and i've already tried the 001
microsoft thing in scope options with a value 002, but without success...
Is there anyway i can prevent clients from seeing each other through network
neighbourhood (and seeing the network), by applying some setting from the
server itself?

Why waist a bunch of time an effort doing something that doesn't matter
anyway? "Seeing" things on a network is meaningless,...accessing things on
the network is what matters. What is "seen" is determined by what is listed
in a compiled Browse List on a Domain Master Browser,...what is accessed is
controlled by File System Permissions in the form of Share Permissions and
NTFS Permissions,..and by Application permissions such as with things like
SQL Server, Exchange Server, etc. The permissions is where you need to
concentrate your efforts.

Even if you stopped them from "seeing" things, they can still access them if
the permissions let them. "Seeing" things in Network Places is not a
prerequisite for accessing resources. Network Places is just "eye candy"
and a convienience.

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com


"Maki" <(E-Mail Removed)> wrote in message
news:6C7FEB65-E621-418A-8E63-(E-Mail Removed)...
> Hello!
> Hope somebody can help me out.
> I've just setup a basic network. Single 2003 server domain controller,
with
> 10 machines attached to it. I've got control over DHCP,DNS,
everything...no
> wins running
> Point is, im trying to prevent users from seeing things through entire
> network (seeing other clients, servers) etc. I do not want to go to every
> computer and disable netbios over tcp, and i've already tried the 001
> microsoft thing in scope options with a value 002, but without success...
> Is there anyway i can prevent clients from seeing each other through
network
> neighbourhood (and seeing the network), by applying some setting from the
> server itself?
>

As Phillip pointed out, this display is driven by the computer browser
service, which in turn depends on Netbios names. If you don't have WINS, it
uses LAN broadcasts.

As you yourself suggested, the best way to really disable it is to
disable Netbios over TCP/IP completely. But you might find that some things
which you really need stop working! Some apps still rely on Netbios names.

You could disable the computer browser service, but there again you
would need to do it on every machine. If you just did it on the servers, a
workstation would take over. Browsing is specifically designed to just work,
even if you only have two machines on a network. And again, you may have
apps which depend on it!

Basically, I agree with Phillip. Just leave it alone.

"Phillip Windell" <@.> wrote in message
news:%(E-Mail Removed)...
> Why waist a bunch of time an effort doing something that doesn't matter
> anyway? "Seeing" things on a network is meaningless,...accessing things
> on
> the network is what matters. What is "seen" is determined by what is
> listed
> in a compiled Browse List on a Domain Master Browser,...what is accessed
> is
> controlled by File System Permissions in the form of Share Permissions and
> NTFS Permissions,..and by Application permissions such as with things like
> SQL Server, Exchange Server, etc. The permissions is where you need to
> concentrate your efforts.
>
> Even if you stopped them from "seeing" things, they can still access them
> if
> the permissions let them. "Seeing" things in Network Places is not a
> prerequisite for accessing resources. Network Places is just "eye candy"
> and a convienience.
>
> --
>
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
>
>
> "Maki" <(E-Mail Removed)> wrote in message
> news:6C7FEB65-E621-418A-8E63-(E-Mail Removed)...
>> Hello!
>> Hope somebody can help me out.
>> I've just setup a basic network. Single 2003 server domain controller,
> with
>> 10 machines attached to it. I've got control over DHCP,DNS,
> everything...no
>> wins running
>> Point is, im trying to prevent users from seeing things through entire
>> network (seeing other clients, servers) etc. I do not want to go to
>> every
>> computer and disable netbios over tcp, and i've already tried the 001
>> microsoft thing in scope options with a value 002, but without success...
>> Is there anyway i can prevent clients from seeing each other through
> network
>> neighbourhood (and seeing the network), by applying some setting from the
>> server itself?
>>
>
>