Access to shares with specified credentials fails in every way

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I am unable to connect to *SOME* shares on the same machine OR from another
machine when specifying credentials, with either NET USE /U or with the GUI
map network drive command using another account. I get access denied errors.

This is despite the fact that the account is in the Administrators group
which has full control (both Share & NTFS permissions).

However as soon as I add a specific ACL for that user account (rather than
just relying on the fact that it is both in Users and Administrators), I can
connect.

Even stranger, when connecting from the same machine, I can connect to a
share without any problems UNTIL I use NET USE /U and specify creds.

Something is very wrong with the way that the Server service is dealing with
credentials passed to it!!!

If anyone at MS is reading this, I'd be happy to provide full details...
Mark MInasi and I have been beating this one up, so I have pretty detailed
info on my tests.

Dan Holme
 
mauidan wrote:

[...]
However as soon as I add a specific ACL for that user account (rather than
just relying on the fact that it is both in Users and Administrators), I can
connect.
Click to expand...

I seem to have such problems making Vista connect to shared resources on
non-windows hosts, which was no problem at all from machines running
2000 or XP (neither with NET USE nor with GUI) - I keep being asked for
the login and being denied access though providing the correct login.
You mean adding a user-specific ACL on the Vista machine could make a
difference? (How would I do that? I can't seem to find any such option
in Vista [5728]...)

Cheers,
Robert
 
Hello,

By default, Windows Vista filters the access token when you authenticate via
the network to a box as an administrator local to the box. This effectively
prevents you from using any administrator powers remotely when authenticated
to a box as an administrator local to that box.

To change this behavior, create or modify the following registry value:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy

This is a DWORD value. Set it to 1.
 
Back
Top