Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Win 2008 R2 Server set up as a Domain Controller. I have configured shared folders for each user (manual set up, as there are only 4 users). On each share, ownership of the folder has been assigned to the user and permissions on the folder and security for all files set for Full Control rights for the user. ICACLS confirms that for all files, the user has full control.

I have one user accessing his share from a Win 7 Pro machine that is not part of the domain, and so is connecting using the "Connect as another user" option (using his domain account). He can access some of the files, but on others receives an "Access denied" message.

My next move is to grant Everyone Full Control access to the files and just rely on the share permissions to limit access - please save me from this evil!

share|improve this question
    
Just to rule out possibilities, can he try accessing it from a domain computer logged in as his domain account and see if he experiences the same problem? –  Stephen Jennings Aug 16 '11 at 6:37

2 Answers 2

up vote 3 down vote accepted

If you run AccessEnum against that user's shared folder, does it show any changes to permissions deeper in the hierarchy? By default this tool shows only files which have more lax permissions than the parent, so try going to Options → "File display options" and choosing "Display files with permissions that differ from parent".

At worst this will rule out any problems with ACLs on the file system; at best, it might uncover a file permissions problem that went unnoticed.

share|improve this answer
    
What a great tool! Sure enough, the ACLs at deeper levels were not allow the user access. If I could award 2 answers to the question, user48838 would also get a tick, but AccessEnum was the thing that got me over the line. Turns out I hadn't unchecked the "Apply these permissions to objects and/or containers within this container only" box. Thanks for your help. –  Darren Oster Aug 17 '11 at 3:04

Although the user is not part of the domain, it does not preclude them for connecting to domain resources as "domain"\"account" (e.g. domain-name\user-account) - is that occurring?

share|improve this answer
    
Yes. There is another shared folder (shared to all users) that the same user can access with no problems - actually, I probably should have mentioned that earlier - so his log in doesn't seem to be the problem. –  Darren Oster Aug 16 '11 at 5:04
    
So the user is mapping to the domain share with a "domain-name\user-account" login? –  user48838 Aug 16 '11 at 5:32
    
Yes, that is correct. –  Darren Oster Aug 16 '11 at 5:48
2  
Ok, then a review of the rights/permissions is in order to seek out/eliminate any possibility of multiple conflicting rights/permissions assignments for those files/folders. In cases where multiple conflicting assignments exists, the most restrictive rights/permissions prevail. –  user48838 Aug 16 '11 at 6:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.