0

I have a Win 2008 R2 Server set up as a Domain Controller. I have configured shared folders for each user (manual set up, as there are only 4 users). On each share, ownership of the folder has been assigned to the user and permissions on the folder and security for all files set for Full Control rights for the user. ICACLS confirms that for all files, the user has full control.

I have one user accessing his share from a Win 7 Pro machine that is not part of the domain, and so is connecting using the "Connect as another user" option (using his domain account). He can access some of the files, but on others receives an "Access denied" message.

My next move is to grant Everyone Full Control access to the files and just rely on the share permissions to limit access - please save me from this evil!

Improve this question
1
  • Just to rule out possibilities, can he try accessing it from a domain computer logged in as his domain account and see if he experiences the same problem?
    – Stephen Jennings
    Aug 16, 2011 at 6:37

2 Answers 2

Reset to default
3

If you run AccessEnum against that user's shared folder, does it show any changes to permissions deeper in the hierarchy? By default this tool shows only files which have more lax permissions than the parent, so try going to Options → "File display options" and choosing "Display files with permissions that differ from parent".

At worst this will rule out any problems with ACLs on the file system; at best, it might uncover a file permissions problem that went unnoticed.

Improve this answer
1
  • What a great tool! Sure enough, the ACLs at deeper levels were not allow the user access. If I could award 2 answers to the question, user48838 would also get a tick, but AccessEnum was the thing that got me over the line. Turns out I hadn't unchecked the "Apply these permissions to objects and/or containers within this container only" box. Thanks for your help.
    – Darren Oster
    Aug 17, 2011 at 3:04
1

Although the user is not part of the domain, it does not preclude them for connecting to domain resources as "domain"\"account" (e.g. domain-name\user-account) - is that occurring?

Improve this answer
4
  • Yes. There is another shared folder (shared to all users) that the same user can access with no problems - actually, I probably should have mentioned that earlier - so his log in doesn't seem to be the problem.
    – Darren Oster
    Aug 16, 2011 at 5:04
  • So the user is mapping to the domain share with a "domain-name\user-account" login?
    – user48838
    Aug 16, 2011 at 5:32
  • Yes, that is correct.
    – Darren Oster
    Aug 16, 2011 at 5:48
  • 2
    Ok, then a review of the rights/permissions is in order to seek out/eliminate any possibility of multiple conflicting rights/permissions assignments for those files/folders. In cases where multiple conflicting assignments exists, the most restrictive rights/permissions prevail.
    – user48838
    Aug 16, 2011 at 6:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .