Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two windwos 2008 standard servers running DFSR okay. I can create a file on one server, it is replicated to the other okay etc. I have the namespace shared folder on each server shared with full control administrators / everyone change/read permissions.

I then browse to the folder on server 1 e.g.\server1\namespace\share\folder1.

I right click the folder, and configure the NTFS permissions as I would like for example Adminsitrators Full Control / One User Read/Write Access / No other users in the user list.

I save this and then double check the second server e.g. \server2\namespace\share\folder1.

I right click the same folder name as before and can see the NTFS permissions have replicated accordingly.

I right click the folder and go to properties - security - advanced - effective permissions and select a user that shouldnt be able to get into that folder e.g. testuser. It agrees with the NTFS permissions and shows that testuser has no ticks next to any permissions so should be denied access.

I logon to any network PC or the server as testuser. Browse to \server1\namespace\share\folder1. It lets me straight in, no access denied messages. The same applies to server2.

It seems as thought all my NTFS permissions are being ignored. I have 1 DFS share and then all the subfolders are a mixture of private folders and public folders so need the NTFS permissions to work ideally. Any idea whats going on? Is this normal? From my tests all users can access any DFSR folder under the namespace\share which is quite worrying.

Thanks

share|improve this question
    
Did you make sure the offline caching on client was disabled ?? Could be a cache you are accessing instead of the real share. –  user151115 Dec 27 '12 at 20:17

2 Answers 2

up vote 0 down vote accepted

The details in your question make it sound like you're doing everything right. But in the interest of troubleshooting, I would probably take DFS out of the equation first. Just setup the share on one of the servers and make sure connecting directly to that share works how it's supposed to. Then add DFS back into the mix and see if it breaks. At the very least, it should verify whether your problem is specifically related to DFS or not.

You might also double check that the subfolder you're accessing is properly inheriting permissions from the parent (assuming it's supposed to be in the first place).

share|improve this answer
    
Hi Ryan, I will give that a go now via VPN and let you know shortly the results. Thanks –  user14930 Aug 5 '09 at 21:05
    
Ryan, I have created a share on server1 and set administrator full control, everyone change. I then went into NTFS Security tab and cleared the list then added administrator full control. I logged onto another server as testuser and tried to access server1 shares and it shows me the list of shares as normal. When i double click the test folder i get access denied as i would expect. Going by this it looks like the issue is with DFS for some reason despite the settings appearing correct to me on both servers –  user14930 Aug 5 '09 at 21:11
    
So with that same test share you setup, add it into a DFS share all by itself. Then try accessing it again. Does it work properly? –  Ryan Bolger Aug 5 '09 at 22:26
    
Hi Ryan, The new DFS share worked as required. Must have been a bug with the inital share for some reason. I deleted initial share / migrated the data to the new share, jobs a good one. Thanks for your help! –  user14930 Aug 6 '09 at 12:08

Access is granted based on the combination of Share permissions and NTFS permissions. What are the Share permissions set to?

share|improve this answer
    
Hiya, The share permissions are set as follows. There is one shared folder in the namespace. The permissions on this folder are Administrator = Full Control. Everyone = Change. Normally as with normal windows shares I set the share to have full access then lock down files with NTFS permissions. Any ideas? –  user14930 Aug 5 '09 at 20:22
1  
Just a note. Share permissions determine the "maximum" permission you can have through the share. It will never grant permissions, only possibly restrict. If the NTFS permissions do not allow access, no amount of share permissions will override that. –  Kevin Kuphal Aug 5 '09 at 21:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.