3

Windows 2008 R2 domain. Users, running Windows 7 Enterprise, are trying to run some software from a network share. Specifically, I've tested this with MATLAB and PuTTY.

When starting, MATLAB has to contact a licensing server to get its license. This action fails for regular users when they start MATLAB from the network share. However, if they copy the installation directory to a local disk everything works fine. Running MATLAB as an admin user from the network share also works.

Same story with PuTTY. If the executable is launched from the share, regular users cannot connect to any servers.

Something is blocking network communications for programs that are launched from a network drive. Here's the only other mention I could find of the same problem:

https://social.technet.microsoft.com/Forums/en-US/w7itpronetworking/thread/4504b192-0bc0-4402-8e00-a936ea7e6dff

It's not the Windows firewall or the IE security settings. Does anyone have any clue as to what this is?

[EDIT]

Quick update - this seems to be related to the fact that the shared drive is actually a DFS share.

For example, if I map Q: to \\server\shared and then run Q:\PUTTY.EXE, everything works fine. If I map Q: to \\my.domain.com\DFS\shared (which is exactly the same share, only accessed through DFS), the process started by Q:\PUTTY.EXE has no network access.

I found another related question, also with no answer:

Can't run utilities that use the network from a Windows Server 2008 DFS share

Improve this question

3 Answers 3

Reset to default
2

I know you think it doesn't have to do with your IE security settings, but I urge you to reconsider. The fact that your DFS share is an FQDN makes me suspect the issue detailed here.

http://support.microsoft.com/kb/303650/en-us

Improve this answer
3
  • There are three reasons why I don't think this has anything to do with security zones: 1) It doesn't affect Domain Admins. 2) I've already tried all possible combinations of entries for Local Intranet zone (fqdn, wildcards, with/without file://, IPs, etc.). All this does is get rid of the Open File security dialog, which is nice, but unrelated to the program's ability to create network connections. 3) This only happens when the program is executed through a DFS share. No problems when connecting to a specific server and running the program from the same share directly.
    – VokinLoksar
    Apr 11, 2012 at 11:27
  • Just to clarify: using FQDN can't be the issue, because I can run the programs from \\dc1.my.domain.com\shared just as easily as \\<IP>\shared. It's only when using \\my.domain.com\DFS\shared that the network connections get blocked.
    – VokinLoksar
    Apr 11, 2012 at 11:29
  • OK, now you have me convinced. :)
    – pk.
    Apr 11, 2012 at 12:36
2

This is actually a permission problem. Let me explain by an example:

Lets say your dfs share is \\dc.domain.com\share1 and on your fileserver the physical location of the share is d:\root\share1.

The group 'mygroup' should have access to share1 and you add "Full permissions" to the group on d:\root\share1. On d:\root you don't give it any access.

In that scenario you will not be able to do any network communcation from the share. But if you give 'mygroup' the "List folder / read data" advanced permission on d:\root, the problem goes away. If you don't want users to be able to list the content of the d:\root folder, just enable "Access-based enumeration".

Improve this answer
1
  • You sir, solved a problem I was working on for 20h. Have my upvote!
    – Manu
    Mar 3, 2022 at 9:44
0

This is a windows permission problem. To get it to run, I had to remove UAC, by going into Control Panel, typing in UAC in the search and selecting "change user account control settings". Now slide the slider all the way down so it says "never notify me". Reboot your PC and now you can run the EXE file from the network drive. Unfortunately this security measure pokes holes in windows, but it's a temporary workaround until someone better with windows can figure out how to only enable this feature without disabling everything else.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .