I Learned SMB File Sharing by Fixing Our Office Scanner

TL;DR: A non-functional scanner connection led me to build a working mental model of SMB, file sharing, and user permissions in Windows.
Why I Did This
I needed to send a scan to my computer. Unfortunately, the Ricoh technician had created a brittle system by setting the destination folder path to my now-invalid IP address, rather than using my computer's name.
What I Did
- On my computer, confirmed that Share this folder was checked and that user ricoh had permission to write to the destination folder.
- Via Local Users and Groups in Computer Management, I created a password for user ricoh.
- Via the printer/scanner's control panel, I created a new folder using my computer's name, and provided ricoh's username + password.
Security Lens
🟥 Red Team POV: Look for users with administrator access set up on auxiliary devices to gain access to a computer.
🟦 Blue Team POV: To limit vulnerability, enforce least required privilege principles and narrowly-defined users for SMB, and make sure Password protected sharing is enabled (Advanced sharing settings).
What I Broke and How I Fixed It
On my first attempt to fix the issue, I failed to provide the scanner with a valid username and password, and the connection failed. To fix this, I created a new password for user ricoh, and created a new folder in the Ricoh machine using //my-computer-name/scanner and the proper credentials. Now, the scanner sends the request to the router, which uses the computer name as a pointer to route it to the current IP address.
Tools Used
- SMB
- Users and Groups in Windows' Computer Management GUI
- File Explorer
- Advanced Sharing Settings
- Ricoh control panel