How to setup discrete pass-protected SMB share for local Android viewing?

Question

I'm on Win10Pro64 and familiar with using SMB shares for local network. However, we currently have a roommate who would like to access some media files I have on network. I'm not comfortable with giving them my user credentials, but I also don't want to utilize unsecured public sharing. Is there any method to define a discrete access group, for which I can designate a password that I control, with which they can access just the SMB shares over WLAN from Android devices?

Notes

• Preferably, I'd like to avoid creating a whole new user for this, as my system partition is installed on an M.2 that is running low on space. I'm not familiar with administrating multi-user networks, so I'm not sure if this is possible to avoid or not, but basically I just want the
  (credential assignment + SMB access - everything else)
• I'm also open to hearing any suggestions or alternatives that achieve the same effect

Similar Posts

• Connecting to multiple network shares on the same host using different credentials?
• Can't map to second share on remote computer
  • When trying to search for existing threads, the two above came across as being the most similar to what I'm trying to accomplish, although still not quite the same. The differences, primarily, being:
  • They are on Windows 7 (posts are dated almost 5 years ago now)
  • They are referring to Enterprise environment, and creating entirely separate user profiles
  • No mention of Android access

Of course, whether these differences actually make any difference or not is unknown to me, but I'm hoping something has changed after half a decade.

Answer 1

Preferably, I'd like to avoid creating a whole new user for this, as my system partition is installed on an M.2 that is running low on space. I'm not familiar with administrating multi-user networks, so I'm not sure if this is possible to avoid or not,

On Windows, separate username/password always means separate user account; it's unavoidable.

However, the user profile on disk should be fairly small, especially if that user never actually logs in interactively – in that case I wouldn't expect it to grow beyond 4–5 MB (that is, if the profile even gets initialized at all).

You can use secpol.msc to disallow interactive logins for certain users or groups ("Local Policies" / "User Rights Assignment" / "Deny log on locally" and "Deny log on through RDS"). Together with the lack of Administrator privileges – don't give admin to roommates – that will only leave File Sharing as the only way to access your system.