How to execute files on LAN drives in a Windows Domain

Question

We have a very small LAN here, but some peolpe here think we need Active Directory, though nobody knows how to maintain it.

I am not in the position to change this.

How can I get full access (on Linux it would be "execute" rights) also for files on network drives (the files are just on another machine next room)

My account is in the group Administrators on a windows 2003 server Domain Controller.

I cannot open simple MS Access 2000 Databases or CHM Files from network drives in the lan

How to do that? Some policy setting? I want to change that once. It is useless. We have no distinction between local or network files here. I would have to copy everything to a local drive and then do what I want.

Edit: When i doublecklick an MS Access file the following happens:

First there is a security popup from windows 2003, askig me if I really want to open this file and telling me that files from the INTERNET are dangerous.

This is strange, because it is not thge internet, it is the intranet.

I accept and then MS Access loads, and displays the program window with all the toolbars, but not the database. Then appears an application-modal message box in the center of the screen on top that says more or less:

I cannot iopen this file, it is outside the intranet. Some files on the internet are dangerous. If you want to oen it you have to copy it to the intranet.

So I have to teach the Domain that the local drives are Intranet?

Answer 1

You need to add your Active Directory domain to the "Local intranet" zone in Internet Explorer. This should eliminate the warning about files from the Internet.

Step-by-step:

1. On your computer (not the DC), open Internet Options (within Internet Explorer or from Control Panel).
2. Click the Security tab.
3. Click the Sites button.
4. Click Advanced.
5. Add your Active Directory domain (the fully-qualified domain name) to the list. (For example, if your AD domain is mydomain.mycompany.local, you would type that whole thing into the box.)
6. Click Close.
7. Click OK.
8. Click OK.

If you need to do this for a bunch of computers, you may want to use Group Policy, Group Policy Preferences, or a logon script using reg.exe to set the appropriate registry key as follows.

Under the key, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains, create a key with the name of the fully-qualified Active Directory domain. Within that new key, create a value with the name *, with type REG_DWORD, and with value 1. Following the example above, the key you create would be named mydomain.mycompany.local, and you would create a REG_DWORD value named * with a value of 1.

Note: These instructions were based on Windows XP and Internet Explorer 7. Newer versions may have changed functionality, labeling, and navigation.

See Internet Explorer security zones registry entries for advanced users on the Microsoft Support site for more information.

Answer 2

Word of advice: take your user out of the Domain Admins group. You don't do your day-to-day work running as the root account in Linux, do you?

Answer 3

Believe it or not, this actually is an IE thing.

Full details here: http://support.microsoft.com/kb/896358.

Answer 4

If you are in the Domain Admins group that should pretty much be all you need. Keep in mind that Deny ACL's take precedence over Allow ACL's so if you are explicitly denied access it will deny you. As a domain admin, you generally have the power to change permissions to give you access to something.