DFS - Destination Folder Access Denied

Question

I have recently setup two Windows servers. One server provides AD and DNS services and the second acts as a fileserver using DFS. When setting up DFS, I chose to use Stand-alone namespaces and did not implement replication as I only want these files on the fileserver.

Whenever I try to move content onto the fileserver's shares, I receive this error - "Destination Folder Access Denied - You need permission to perform this action". The same happens when I try to create folders or text files on the server. This error is occurring while I am logged into the machine as the domain administrator.

Using the DFS Management snap-in in Server Manager, I have been able to create new folders for each DFS share, but the permission errors still occur when trying to add any form of content to these folders. In the snap-in, I set the permissions in the Delegation section so that 'BUILTIN\Administrators' and 'BUILTIN\Users' should have full permission in these shares, but the problem persists.

Is this problem being caused by the DFS share settings or something else?

Answer 1

There are two levels of permissions when accessing network file resources:

When you access local data, file access is controlled by only the NTFS permissions. But when you access a file share over the network, access is controlled by the combination of the NTFS permissions AND the share permissions. The effective permissions are the most restrictive of the two. Older OS's (like 2003) defaulted to share perms of Everyone/Full, but newer OS's (2008 or later) default to share perms of Everyone/Read. Suspect you have defaults in place (that you may have been unaware of) at the share perms level. http://technet.microsoft.com/en-us/library/cc754178.aspx

In most cases, I prefer to change the share perms to Everyone/Full or Change, which means I only have to worry about managing permissions at the NTFS level.

If this is not the case, could you please describe the NTFS perms, and share perms in place on each DFS target.