Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an interesting problem... I need the local SYSTEM account on one server to access a specific network share on another server. Due to other reasons I can't use a regular domain account for the time being.

Using "psexec -s" I have played around with connecting to network shares under the local SYSTEM account with "net use". Since I am in a domain, I can simply add the DOMAIN\COMPUTER$ account to the share and NTFS permissions.

That seems to work fine everywhere except for one server. If I add "Everyone" to the share and NTFS, then that one server can connect. I noticed in the NTFS permissions (Security tab) that all the other servers I add have a computer icon on the left. This one server has a user icon. When adding the account I specifically said to only search for computers in the domain. And if I don't select computers, it never finds the account.

Basically, it seems the server account in the domain is different/corrupt in some way. Has anyone come across this? I would try re-adding the server, but it's critical and needs to be up as much as possible. I'm hoping there is a solution within Active Directory or something...

share|improve this question

4 Answers 4

It does sound to me like something is screwy with that account. Why not remove the server from the domain, delete the account and rejoin it?

share|improve this answer

I agreee something is very off about that account. The only thing I can suggestion (and this is way out of left field) without removing the machine from AD and rejoining is to try resetting the account password, maybe you'll get lucky Technet linky

share|improve this answer
up vote 0 down vote accepted

Apparently the icon was insignificant. I tried to show someone else and then the icon appeared correctly. I clicked OK, opened the permissions back up and the icon was back to the user icon. The server is not fully patched, so maybe there's an update for this. Either way, that wasn't the problem.

What it actually was... There was a batch file running as SYSTEM from time to time. It was doing a "net use \server1\share1 /user:domain\account /password *" and never deleted the connection. So when I was running the command prompt as SYSTEM and trying to connect to \server1\share2 (without specifying credentials), it was actually using the cached domain\account. I had checked the Security Event Log, but never saw that domain account (the server may not be auditing everything...) Once I fix another problem I should be able to use domain accounts and prevent all this from happening.

Anyway, thanks for trying to help.

share|improve this answer

As a general rule you are better off using the "Authenticated Users" group instead of the "Everyone" group. Functionally, they are nearly identical in most practical ways and slightly more secure.

share|improve this answer
1  
Yes, I agree. Since XP/2003 "Everyone" is even closer (no unauthenticated accounts), but still a few differences. –  Nelson Rothermel Jan 11 '10 at 13:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.