Access domain member share, logon dialog

This isn't a solution, no client settings could be made, because people are using laptops that aren't managed by us to access the fileserver.

It has to be set on the server...

AFAIK, it is not possible on the server, you cannot force the client to authenticate to a domain when they are not members, hence the need to enter the domain\user as credentials.

But when no domain is entered can't the server also check the domain users when a local user isn't found?

No, because it is the client which is authenticating to the local SAM.

If you have permissions on the share then you should not be asked for credentials, if you have set the share and NTFS permissions and are getting this prompt it is likly to be down to an invalid cached credential:-

 - to clear it -
Go to Control Panel->User Accounts. Select your user account, then select Manage Network Passwords and clear any cached credentials.


If you have not set both the share and NTFS permissions then:-

When you share a folder it has share permissions. For the most part, if your drives are formatted as NTFS then give the 'Everyone' Group 'Full Control' at the share level (you will need to change the default permission on the Sharing Tab as the Default is 'Everyone' Read). This may seem odd and insecure but it is not as NFTS itself allows you much greater control of permissions. It is usual to allow full control at the share level and then tie down permissions with NTFS.

If you right click on a folder and go to the Security Tab, it will show you the NTFS Permissions. Normally you will want a shared folder not to inherit permissions from its parent folder or drive, So go to the Advanced Tab and clear the 'Inherit from parent...' box and COPY the permissions when prompted.

You can then edit/add/remove groups from the security tab and assign each the required permissions. So if you want the Marketing Group to have full access to a folder, add the Marketing Group and Assign them Full Control. If you want the Sales Group to be able to read the folder and files but not add/delete/change anything, add the Sales group and leave the default permissions, (read, read and execute list folder contents). To stop others accessing the folder remove the Everyone and (domain) Users Groups from the list.

It is enough that groups do not appear on the list to stop them getting access. You do not normally need to DENY. If a user is a member of two or more groups they get the best of their cumulative NTFS Permissions (unless a deny is present, in which case it overrides).

Normally the standard permissions will be sufficient for most purposes; if you want to be more prescriptive you can use the 'Advanced' option and set advanced permissions.

If users have both share and NTFS permissions they get the most restrictive of the combination of the combined NTFS/Share permissions (which is why it is normal to allow Full Control on the share and rely on NTFS permissions)

It is usual to give permissions to groups, not to users as this makes for easier management. If a new person joins the sales team, you just add them to the sales group and they automatically get all the permissions assigned to the Sales Group. If someone moves from Marketing to sales you remove them from the Marketing group and they lose all the Marketing Group Permissions, when you then add them to sales they get all the permissions of the sales group. As already stated a user can be a member of multiple groups.

See http://www.windowsecurity.com/articles/Understanding-Windows-NTFS-Permissions.html for more info

Once a folder is shared with the correct folder and NTFS permissions users can connect to it using the UNC path name, it they can type \\ServerName\ShareName at the run Prompt. Alternatively they can map a drive to the folder. To do this click on Tools, Map Network drive in Windows Explorer and  assign any unused drive letter to the shared folder. The folder will then appear a s Network drive in "My Computer"

An analogy. Your computer is a house. Your data is in as safe the house. To gain access to the data people from outside have to go through the front door (the share), and then open the safe (NTFS). They need to have both the key to the door (share permissions) and the key to the safe (NTFS permissions) to get at the data - having one key or the other is no good - they must have both

KCTS : did you respond to the right question here?

The end user machines are not part of the domain so they will always be prompted for credentials.

I should get new specs - I missed the "from a not domain member" bit

I'll go back to sleep for a bit now....

I think we can let you off, one off response in the 100s and 1000s that you do!!

Ok, I'm logging in from a non domain member on a on a share from a domain member with credentials from the domain.  I want to give users the possibility to just enter their username instead of domain\username

Like I said before configuring clients isn't possible because their aren't managed by us, we can only configure the domain member (with the share we cant to access and the domain controller with the username on it that we are using to login)

cant = want in the last post

Sure?

So using the domain to first authenticate users isn't possible

Ok, thanks