• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5228
  • Last Modified:

"Windows cannot calculate effective permissions" for a group in trusted domain. Windows 2003 Server.

I'm working in a company which has AD 2003 domain (Domain A), we also have offices in China (Domain B), which have their on AD envornment. There's a two-way trusted relationship between the domains.
I'm trying to add the group from Domain B to security and share permissions of one of the folders on our server from Domain A. When I add it - it finds the group from another domain fine. However, when I go to display effective permissions I get the message that Windows cannot calculate effective permissioins.
Domain B users from that groud say that they cannot access the folder. They ping the server fine.
Any Ideas.  
0
a_kreydin
Asked:
a_kreydin
  • 2
1 Solution
 
kzabbottCommented:
What type of group scope are you using for the folks in Domain B?  If these are two separate forests (as I think they are, from your description), then keep in mind that only Domain Local groups can cross the Forest Root Trust.  If they are not in a Domain Local Group in Domain B, try converting the group to Doamin Local.

If that is set correctly, then (and this is just a guess) did you remember to set your firewalls correctly to allow the appropriate traffice between the two domains?
0
 
a_kreydinAuthor Commented:
Turns out there's an authentication problem.
I looked through the log and have and found this error message:

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      537
Date:            8/6/2007
Time:            2:18:53 PM
User:            NT AUTHORITY\SYSTEM
Computer:      <SERVER NAME>
Description:
Logon Failure:
       Reason:            An unexpected error occurred during logon
       User Name:      Administrator
       Domain:            <DOMAIN B>
       Logon Type:      3
       Logon Process:      NtLmSsp
       Authentication Package:      NTLM
       Workstation Name:      <workstation on Domain B>

As I mentioned earlier - I was able to access folders with identical permissions which I have created on another server. Security settings for LAN Authentication are identical on all servers. Any Idea what else to look for?
0
 
deyamagCommented:
windows cannot calculate the effective permissions for SYSTEM
G0' E' -/+ E9J (HJF/H2 %C3 (J (1H H CE(JH*1 EF2DJ DJ3 E1*(7 (4(C) .
E' 'DEB5H/ #JG' 'D#3H/ .
4C1'K DD,EJ9 .
0
 
deyamagCommented:
windows cannot calculate the effective permissions for SYSTEM
G0' E' -/+ E9J (HJF/H2 %C3 (J (1H H CE(JH*1 EF2DJ DJ3 E1*(7 (4(C) .
E' 'DEB5H/ #JG' 'D#3H/ .
4C1'K DD,EJ9 .
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now