Windows – Default username/password for accessing network shares in Windows 8

You need to remember that there are user accounts and machine accounts. Machine accounts are used pretty much just to join the machine to a domain. User accounts are used to log on to computers or domains. Managing access to shares is done via user accounts. Users log on to either local computers (i.e. Workgroup scenario) or to a Domain (i.e. a machine that acts as a domain controller supplies authentication credentials to all network users - runs either Windows server or Linux Samba). Simplest home use case is logging to each PC separately which is workgroup model. That happens even in the case if your PCs just start up and go to start button screen without any login - there still will be a user account on that machine which "auto-logs-on". (Explore users with mmc command - this will open Microsoft Management Console).

Case 1: Workgroups

Disable "simple file sharing" via Tools - Folder Options - View - Advanced settings - see also. Right click the folder and share it via Sharing and Security. Whilst you are at it, set permissions via button Permissions. Two scenarios here:

1. First is when you grant access via local username and password that exists on the computer sharing the folder. Say it is USER1. In permissions give access only to USER1. Make sure on all other computers there is no USER1. Then upon connecting users will be asked username and password. If person using the computer from which you do not want to allow access does not know the username and password - he/she won't be able to access the share. Of course - everybody else will have to remember the username and password and also resist temptation of giving those credentials to that user you wish to exclude.
2. Scenario 2 is when your users are oblivious to network usernames passwords, etc and they come to computers that "auto-log-on". Which means they do not know no passwords no nothing, I just use my computer, man. They just come to a computer that boots to the Start button screen. You can make use of that. Note user names on computers from which you want to access shares. On your sharing computer create user accounts with exact same usernames AND same passwords as on the allowed computers. When sharing the folder - give permission to those users. You could also set up user name exact same as for the user on the computer which you want to exclude. When giving permissions to that account on your sharing computer - you remove all access. What your users will see - they can access the shares from the "allowed" computers and will be denied access from the "excluded" computer. Behind the scenes your sharing computer will look at the access requests in such a way: who is asking? - user1 - what's your password? - password1 OK you can access. When the excluded computer will connect - exact same exchange will happen, except the last response will be Access Denied!. It works only because the usernames and passwords on accessing computers have been set up by you to be the same as usernames passwords on the sharing computer. Say you have 4 accessing computers - they each will have one user account. On the sharing computer you will have at least 4 accounts then (unless all the accessing computers are set up with the same username / password "auto-logon" in which case you will have 2 accounts on the sharing computer - one for the accessing computers and 1 for the excluded computer). Only reason why it works without asking is because usernames and passwords match and the computers try to sue the only credentials they have at hand. From any network security perspective this is ... hmm... not great, Cthulhu way, I guess. But it will work unless your users start fiddling with those accounts they are automatically logged on to.

Case 2: Domains

Way more simple - all users log on to a domain - so all usernames are stored centrally. So you can restrict access to shares from the central server - just when you share, then you specify allowed users like this DOMAIN\User1 etc. The users who are not specifically be permitted will not get in. You of course need to remember to remove access for the Everyone group.Nice and easy way, but requires you to run either Windows server (costs $) or set up SAMBA 3 or 4 server on Linux.

Case 3? Firewall

You, I suppose, could use a software firewall on the sharing machine to specifically exclude traffic coming from the IP address of the machine you want to exclude. It would be enough to tell the firewall to drop tcp/udp traffic for ports 138 and 139 if requests come from that IP address. That would have to be some other firewall than the standard windows XP firewall though. Well, you could even use a firewall on the machine that you want to exclude - tell that machine to drop all packets from the sharing machine that come from ports 138 and 139. Another Chtulhu way ... may work, provided your users will not undo your changes ;).

To explain the problem :

On Window 8.1, and presumably Windows 8, when using a Microsoft account to login to Windows, the default user-name when you make a network connection is MicrosoftAccount\<live_id_username>, instead of the login <computer_name>\<username> as in previous versions of Windows.

This MicrosoftAccount form is likely to cause a login failure on any server that is not using a Microsoft account, due to the strict way that Microsoft/Local accounts are implemented in Windows 8/8.1.

I have not been able to find a way of forcing Windows 8/8.1 to use the old format of computer-name\user-name, unless with one of the workarounds you have listed in your post. Probably this problem needs to be addressed by Microsoft itself.

I have tested and this is still true in Windows 10, so don't expect any improvement. Unfortunately, this is just the way that Microsoft/Local accounts were implemented.