Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

-

Dear fellows,

being a plain linux and not a windows guy, today I've been really stunned by an effect with share permissions I've never thought to be possible.

AD domain with a windows 2003 server providing a share which has share-level permissions set (via an AD group). Whoever is not a member of that group should not be able to map that share, right?

Right - as long as you're logged in as mere mortal on a client PC of this domain and try to map with the credentials of another non-admin user:

net use K: \\server\share /user:otherUser Password

you'll get "System error 5. Access is denied", because otherUser has no share-level permissions.

Wrong: as soon as you log into the same client PC with a domain admin account, that very same share mapping command succeeds like a charm, even though still done as otherUser (which still has no share-level permissions at all)!

So even though the net use ... should transfer only otherUser's credentials to the server, it seems to also transmit who is doing the net use ...?

By the way - neither the non-admin nor the domain-admin accounts doing the net use ... /user:otherUser commands had share-level permissions, if that explains anything...

Am I right in guessing that share-level permissions do not apply to domain admins, even though their net use ... is done as a mere mortal "otherUser"? That's my only idea why this is as it is...

Confused regards

share|improve this question
1  
Go to \\server, open Computer Management, look at that share, and check what user ID is mapped, if it's otherUser or the domain admin's account. –  mfinni Apr 12 '13 at 16:36
    
If the domain admin user already had a connection to any share on the server, perhaps one reestablished automatically from a previous session, the /user flag will be ignored. –  Harry Johnston Apr 30 '13 at 5:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.