0

-

Dear fellows,

being a plain linux and not a windows guy, today I've been really stunned by an effect with share permissions I've never thought to be possible.

AD domain with a windows 2003 server providing a share which has share-level permissions set (via an AD group). Whoever is not a member of that group should not be able to map that share, right?

Right - as long as you're logged in as mere mortal on a client PC of this domain and try to map with the credentials of another non-admin user:

net use K: \\server\share /user:otherUser Password

you'll get "System error 5. Access is denied", because otherUser has no share-level permissions.

Wrong: as soon as you log into the same client PC with a domain admin account, that very same share mapping command succeeds like a charm, even though still done as otherUser (which still has no share-level permissions at all)!

So even though the net use ... should transfer only otherUser's credentials to the server, it seems to also transmit who is doing the net use ...?

By the way - neither the non-admin nor the domain-admin accounts doing the net use ... /user:otherUser commands had share-level permissions, if that explains anything...

Am I right in guessing that share-level permissions do not apply to domain admins, even though their net use ... is done as a mere mortal "otherUser"? That's my only idea why this is as it is...

Confused regards

2
  • 1
    Go to \\server, open Computer Management, look at that share, and check what user ID is mapped, if it's otherUser or the domain admin's account.
    – mfinni
    Apr 12, 2013 at 16:36
  • If the domain admin user already had a connection to any share on the server, perhaps one reestablished automatically from a previous session, the /user flag will be ignored. Apr 30, 2013 at 5:22

0

You must log in to answer this question.

Browse other questions tagged .