1

I got a system error 5 while mapping a network drive of a server to my local machine using the net use command.

This error doesn't occur when I use Administrator account of the server. When I use my user account the net use command gives system error 5.

But, my user account is added to the Administrators group on the server. Can you please help me with this?

2

7 Answers 7

3
+50

Here's a helpful hint re: those error messages: If you ever need to diagnose error messages from the "NET" command, just go a "NET HELPMSG ". Like, for example:

C:\Documents and Settings\w00tw00tw00t>net helpmsg 5

Access is denied.

C:\Documents and Settings\w00tw00tw00t>

So, you're getting an "Access is denied".

What's the share you're trying to access? Are you seeing anything in the "Security Log" on the server computer re: failures?

5
  • OP stated "But, my user account is added to the Administrators group on the server."
    – Wesley
    Sep 24, 2009 at 1:40
  • Yeah-- reading is hard. >smile< Sep 24, 2009 at 1:46
  • I know, especially when I'm about 7 years overdue for some contacts. This is 2009, people! Shouldn't HAL be reading forum posts to me while I lounge on the holodeck in the Millenium Falcon? Modern "technology". Pshaw. =)
    – Wesley
    Sep 24, 2009 at 2:10
  • i cannot access any share. Sep 24, 2009 at 4:59
  • +1 for mentioning net helpmsg #
    – Izzy
    Oct 8, 2009 at 15:28
3

I'm assuming that both of these systems are not joined to any domains. Windows Vista Home Premium cannot be joined to a domain so you are definitely dealing with a scenario where this might apply. If the Windows 2008 Server was part of a domain then I don't think you would be able to connect (to the administrative shares) at all from a non domain joined system unless you had made some changes to the default security settings.

UAC on Windows Server 2008 by default prevents access to administrative shares from non domain joined systems using credentials that are part of the administrators group even though the explicit permissions appear to allow it. See this KB article for details on how to work around this.

Use of the explicit Administrator credentials means that you get a different behaviour than when you connect (or attempt to connect) using a credential that is simply a member of the administrators group. The default behaviour of UAC on non-domain member systems enables full privilege elevation when you connect with the built in Administrator account but does not do this for accounts that are members of the Administrators group. That reference is for Vista but I'm pretty certain the same default applies to W2K8 when in workgroup mode.

2
  • The server 2008 system is not part of any domain. Oct 8, 2009 at 20:26
  • That would be the problem then - the default behavior treats the explicit Administrator account differently to members of the Administrators group. If you disable UAC (on the W2K8 server) does the behavior change? If you need to change the beahviour then my advice is to follow the instructions in the linked KB article and re-enable UAC.
    – Helvick
    Oct 8, 2009 at 23:49
2

Check the share permission. Just because the account is in the administrators group does not necessarily mean it has permission to access the share. Assume nothing.

1

rboorgapally, just to expand on John Gardenier's thought, check to see if your account or any group that your account is a member of has any explicit deny permissions assigned to it for those shares. Deny permissions supersede all allow permissions in all cases.

2
  • The shares I am accessing are default administrative shares (C$, D$ etc). I do not think any one is allowed to modify the permissions for these shares. Sep 24, 2009 at 15:36
  • I think it's possible using a registry hack. TweakUI can purportedly do this for an XP machine, but I'm not sure if it can work on a Windows Server OS. Besides, I hope no one is using Tweak UI on your server... =) I suppose that later on we can check the proper regkeys to see if someone (or something...) has edited the default values. For now, check the NTFS permissions on the shares' target folder. E.g. for C$ check the NTFS permissions for C, etc. Once again, see if any groups that your account is a member of or your user account itself has a deny permission.
    – Wesley
    Sep 24, 2009 at 16:02
1

use the runas command

runas /user:administrator "net share sharename=driver:\path"
0

also, beware the deny in windows shares...a deny for the Everyone group will prevent other permissions from working correctly

0
  1. Assume nothing
  2. go over all security properties of the share,
  3. go over all security properties of your account
  4. check what credentials are known to the server as it is not in the domain

When I've had such problems in two-PC network, I made sure that there is an account with the same username and password on both computers and it has to be logged in on the client (the one issuing net use) computer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .