-
Dear fellows,
being a plain linux and not a windows guy, today I've been really stunned by an effect with share permissions I've never thought to be possible.
AD domain with a windows 2003 server providing a share which has share-level permissions set (via an AD group). Whoever is not a member of that group should not be able to map that share, right?
Right - as long as you're logged in as mere mortal on a client PC of this domain and try to map with the credentials of another non-admin user:
net use K: \\server\share /user:otherUser Password
you'll get "System error 5. Access is denied", because otherUser
has no share-level permissions.
Wrong: as soon as you log into the same client PC with a domain admin account, that very same share mapping command succeeds like a charm, even though still done as otherUser
(which still has no share-level permissions at all)!
So even though the net use ...
should transfer only otherUser
's credentials to the server, it seems to also transmit who is doing the net use ...
?
By the way - neither the non-admin nor the domain-admin accounts doing the net use ... /user:otherUser
commands had share-level permissions, if that explains anything...
Am I right in guessing that share-level permissions do not apply to domain admins, even though their net use ...
is done as a mere mortal "otherUser"? That's my only idea why this is as it is...
Confused regards