3

I have two Windows 2008 Standard servers running DFSR okay. I can create a file on one server and it is replicated to the other okay, etc. I have the namespace shared folder on each server shared with Full Control for Administrators and Modify permissions for Everyone.

  1. I then browse to the folder on server 1, e.g. \\server1\namespace\share\folder1.

  2. I right-click the folder and configure the NTFS permissions as I would like them to be. For example Administrators Full Control, one user Read/Write access, and no other users in the user list.

  3. I save this and then double-check the second server, e.g. \\server2\namespace\share\folder1.

  4. I right-click the same folder name as before and can see the NTFS permissions have replicated accordingly.

  5. I right-click the folder and go to Properties > Security > Advanced > Effective Permissions and select a user that shouldn't be able to get into that folder, e.g. testuser. It agrees with the NTFS permissions and shows that testuser has no ticks next to any permissions and so should be denied access.

  6. I logon to any network PC or the server as testuser. I browse to \\server1\namespace\share\folder1. It lets me straight in, no access denied messages. The same applies to server2.

It seems as though all my NTFS permissions are being ignored. I have one DFS share and then all the subfolders are a mixture of private folders and public folders so I need the NTFS permissions to work like they usually do. Any idea whats going on? Is this normal? From my tests all users can access any DFSR folder under the namespace\share which is quite worrying.

Thanks

4
  • Access is granted based on the combination of Share permissions and NTFS permissions. What are the Share permissions set to?
    – joe webster
    Aug 5, 2009 at 18:54
  • Hiya, The share permissions are set as follows. There is one shared folder in the namespace. The permissions on this folder are Administrator = Full Control. Everyone = Change. Normally as with normal windows shares I set the share to have full access then lock down files with NTFS permissions. Any ideas?
    – user14930
    Aug 5, 2009 at 20:22
  • Just a note. Share permissions determine the "maximum" permission you can have through the share. It will never grant permissions, only possibly restrict. If the NTFS permissions do not allow access, no amount of share permissions will override that. Aug 5, 2009 at 21:13
  • Did you make sure the offline caching on client was disabled ?? Could be a cache you are accessing instead of the real share.
    – user151115
    Dec 27, 2012 at 20:17

1 Answer 1

1

The details in your question make it sound like you're doing everything right. But in the interest of troubleshooting, I would probably take DFS out of the equation first. Just setup the share on one of the servers and make sure connecting directly to that share works how it's supposed to. Then add DFS back into the mix and see if it breaks. At the very least, it should verify whether your problem is specifically related to DFS or not.

You might also double check that the subfolder you're accessing is properly inheriting permissions from the parent (assuming it's supposed to be in the first place).

4
  • Hi Ryan, I will give that a go now via VPN and let you know shortly the results. Thanks
    – user14930
    Aug 5, 2009 at 21:05
  • Ryan, I have created a share on server1 and set administrator full control, everyone change. I then went into NTFS Security tab and cleared the list then added administrator full control. I logged onto another server as testuser and tried to access server1 shares and it shows me the list of shares as normal. When i double click the test folder i get access denied as i would expect. Going by this it looks like the issue is with DFS for some reason despite the settings appearing correct to me on both servers
    – user14930
    Aug 5, 2009 at 21:11
  • So with that same test share you setup, add it into a DFS share all by itself. Then try accessing it again. Does it work properly? Aug 5, 2009 at 22:26
  • Hi Ryan, The new DFS share worked as required. Must have been a bug with the inital share for some reason. I deleted initial share / migrated the data to the new share, jobs a good one. Thanks for your help!
    – user14930
    Aug 6, 2009 at 12:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .