How Windows 98 Managed Network Share Permissions

Unlike modern operating systems that rely on NTFS access control lists, Microsoft Windows 98 used the FAT16 and FAT32 file systems, which offered zero native file-level security. Consequently, Windows 98 managed file permissions on network shared folders entirely through the networking subsystem rather than the local file system. Network access was governed by one of two distinct security models configured in the Network control panel: Share-level access control or User-level access control.

The Foundation: FAT File System Limitations

Windows 98 operated on FAT16 or FAT32, neither of which supported metadata for user permissions, ownership, or Access Control Lists (ACLs). This meant any security applied to a folder only functioned over the network via Server Message Block (SMB) file sharing. If a user gained direct physical access to the machine, all files could be accessed, modified, or deleted without restriction.

Share-Level Access Control

Share-level access control was the default security model for Windows 98, primarily designed for simple peer-to-peer workgroup environments without a dedicated server.

Under this model:

  • Password-Driven Access: Permissions were attached to passwords rather than user accounts. Anyone on the local network who knew the password could access the share.
  • Three Access Types: When sharing a folder, the administrator could choose from three permission options:
    1. Read-Only: Users could view and copy files but could not modify, overwrite, or delete them. A specific read-only password could be assigned.
    2. Full: Users had complete access to create, modify, and delete files within the share. A full-access password could be assigned.
    3. Depends on Password: Two separate passwords were created—one for read-only access and another for full access. The level of control granted to a remote user depended entirely on which password they entered when connecting.
  • Blank Passwords: If a password field was left blank, any network user could connect with that tier of access without authentication.

User-Level Access Control

For enterprise environments, Windows 98 supported User-level access control. Because Windows 98 had no built-in security accounts manager (SAM) or local user database, it could not manage user-specific lists on its own. Instead, it relied on pass-through authentication from a dedicated network server.

Under this model:

  • External Authentication: Windows 98 queried an external authenticator—either a Microsoft Windows NT Server domain controller or a Novell NetWare server—to retrieve a list of valid users and global groups.
  • Granular Rights Assignment: Once connected to the authentication server, administrators could assign specific rights to individual accounts or groups. The available permissions included:
    • Read Files: Allows opening and reading data.
    • Write Files: Allows modifying existing files.
    • Create Files and Folders: Allows adding new data.
    • Delete Files: Allows removing files and subfolders.
    • Change File Attributes: Allows altering metadata such as Archive, Hidden, or System flags.
    • Make Folder Changes: Allows reorganizing the folder hierarchy.
  • Pass-Through Verification: When a network client attempted to connect, Windows 98 verified the user's credentials against the domain controller or NetWare server before granting the mapped permissions.

Inherent Security Weaknesses

Windows 98 network security was basic by contemporary standards. It relied heavily on the legacy LAN Manager (LM) authentication protocol, which transmitted weak password hashes easily susceptible to interception and cracking. Furthermore, subfolders within a shared directory automatically inherited the permissions of the parent share; Windows 98 could not configure unique permissions on individual files or nested subfolders within a shared resource.