being a plain linux and not a windows guy, today I've been really stunned by an effect with share permissions I've never thought to be possible.
AD domain with a windows 2003 server providing a share which has share-level permissions set (via an AD group). Whoever is not a member of that group should not be able to map that share, right?
Right - as long as you're logged in as mere mortal on a client PC of this domain and try to map with the credentials of another non-admin user:
net use K: \\server\share /user:otherUser Password
you'll get "System error 5. Access is denied", because
otherUser has no share-level permissions.
Wrong: as soon as you log into the same client PC with a domain admin account, that very same share mapping command succeeds like a charm, even though still done as
otherUser (which still has no share-level permissions at all)!
So even though the
net use ... should transfer only
otherUser's credentials to the server, it seems to also transmit who is doing the
net use ...?
By the way - neither the non-admin nor the domain-admin accounts doing the
net use ... /user:otherUser commands had share-level permissions, if that explains anything...
Am I right in guessing that share-level permissions do not apply to domain admins, even though their
net use ... is done as a mere mortal "otherUser"? That's my only idea why this is as it is...