3

The business is in the middle of migrating from Windows workgroup to Windows domain.

We have a network share on the domain, that we want accessible to the workstations which are still in the workgroup. (We will be migrating the workstations as time allows.)

Domain administrator accounts can access the share from the workgroup machines but standard user accounts cannot.

2 Answers 2

4
  1. In the share permissions and NTFS permissions, you want to give access to an Active Directory security group or groups. I normally give Everyone full access in the share permissions and manage my access via NTFS permissions.

  2. You add users to that group that you want to give access to. Even if their machines are not yet joined to the domain.

  3. The users in the workgroup can map that share with their AD credentials, even if their workstation isn't joined to the domain yet by going though the Map Drive wizard in Explorer or by using the command-line net use command with the /user switch.

3
  • I had originally tried with the "everyone" group and it did not work. I just created another group "employees", added all the user accounts, gave access to the share to the group. And I still cannot access the share. BTW: using Server 2011 SBS, and mix of XP SP3 and Vista Workstations. Sep 12, 2011 at 14:48
  • 1
    You need to make sure that the NTFS permissions on the server allow access as well. It's more than just the share permissions.
    – MDMarra
    Sep 12, 2011 at 14:50
  • I changed the NTFS and still no joy (but it was needed). I poked around the MS Help some more and found a mentioning of "Advanced Sharing Settings" and had turn on "Public Sharing" for the Domain. Thanks for the help. Sep 12, 2011 at 15:58
-4

It shouldn't matter what any of the permissions are on the share or NTFS when it comes to being authenticated by server (accessing files/shares, yes, but not authentication) - the server should use the credentials you specify when attempting to connect. If none are specified, it tries to use the credentials of the user logged on to the workstation. Example: PC named "BOBS-PC" and user account "BOB" with password "Bob'sPassword", Server named "SERVER", domain named "OURDOMAIN", with a user account of "MIKE" and password of "Mike'sPass". If the user attempts to connect to the domain-joined server (or even a non-domain joined server) it will try using the account "BOB" with password "Bob'sPassword" - if no account "BOB" with matching password is found, it denies access.

You can specify what credentials you want to do when mapping drive letters, in which case, you want to specify an account with proper credentials on the domain. Either create an account "Bob" with password "Bob'sPassword" on the domain, or specify an account that already exists in the domain in the format of domain\user - using the above example info, you would connect as "OURDOMAIN\MIKE" as the username and "Mike'sPass" as the password.

If you find you are not prompted for the account name and password (Windows usually prompts you but can take several LONG seconds to do so) and you don't want to map a network drive, then you can connect via the command line using NET USE:

NET USE \SERVER\SHARE * /USER:OURDOMAIN\MIKE

you should then be prompted for a password - enter Mike's password. NOTE: you cannot connect to the same server as two or more users.

To avoid prompting, make sure the local user account (BOB in the example above) has an identical account name AND PASSWORD on the domain - then when the client attempts to access the server, the credentials match and it should give immediate access.

Also NOTE: The only thing that is case sensitive in the above examples is the password - I use CAPS simply to highlight the commands/syntax.

Of course, I don't know why you wouldn't just join the workstation to the domain and be done with it.

3
  • 1
    Um, share and NTFS permissions certainly do matter, unless you have the Everyone ACE in your share/NTFS permissions and that's bad news. Typically Everyone is in the Share permissions and then actual access is granted through underlying NTFS permissions on the server. When you are connecting with Bob or Mike's credentials, you still need Bob and Mike to have access granted through both share and NTFS permissions. Also, if you want windows to prompt your for a password immediately, put an asterisk after /user:foo\bar.
    – MDMarra
    Sep 13, 2011 at 23:29
  • Mark M - thanks for commenting on that - that was an unfinished thought when I said the NTFS permissions don't matter. Will edit. Other than that unfinished thought, can anyone honestly say my information is otherwise incorrect - and if explain why you feel it is? Sep 16, 2011 at 0:57
  • You completely missed the "non Windows" part of the question.
    – smaudet
    Dec 5, 2016 at 15:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .