My Documents "Destination Folder Access Denied" in Windows Vista

Within our Domain we have the My Documents folder being redirected to a file server (\\fileserver\mydocs$\) via GPO. All of our users, with the exception of one, have no issues. However one of our users cannot create, save, or delete files within the redirected My Documents folder.

If you attempt to create a new Text Document, an error comes up stating, "You need permission to perform this operation". If you click cancel, it will create the text document with the default name of New Text Document.txt

Attempting to delete any files, including the New Text Document, results in the same error. I have reset the permissions on the folder, ensuring that the user is the owner - but her permissions setup is no different than any of the other users and even after resetting them, she still has the issue. Logging in with a test Domain User account also has the same results. Administrator accounts have no issues creating or deleting information from the My Documents folder. What is interesting is that if the user performs a SHIFT+DEL to permanently delete, it allows them to do so with no issues.

I have tried a gpupdate /force thinking perhaps it was a mis-sync from local copies to the network for some reason, but this did not resolve the issue. I have also tried disabling UAC, thinking that it was explicitly a Vista issue, but that was not the case. Any ideas of what setting on the local machine could be causing this behavior?
Permissions.bmp
LVL 3
Cameron_SAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

warturtleCommented:
Try using CCleaner (www.ccleaner.com) on that machine, maybe there's some unneeded entries in the registry that needs clearing up and then restart and try.
0
warturtleCommented:
Another thing you can try is to download SubInACL.exe file from Microsoft:

http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

Then query the folder that you are trying to access to see exactly what permission it is and then set the permissions using the SubInACL tool. A thread that will help you by giving sample script is here (although its only for admins, but you can change users and instead of setting permissions you can query them first):

http://www.experts-exchange.com/Networking/Windows_Networking/Q_21903279.html

Hope it helps.
0
Cameron_SAuthor Commented:
The problem is definitely not permissions. I was able to have the user try another PC within the Domain and it functioned perfectly fine, so it is something on the workstation that is preventing the user.

I tried deleting the local profile of the test account I was working with to see if that was the issue and now each time I login with the test account, Vista tells me there was a problem loading my profile and that it is creating a temporary profile.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

ChiefITCommented:
When, getting a kerberos ticket from the ticket granting agent, (that is matched up to the ACL), your computer and user passwords will be matched up to active directory. If the computer password is incorrect, you may be able to deceptively logon to the domain, but are not really within the domain. It would be much like logging in locally with the same username and password. Access to your file shares will not match the ACL. Also, you should have problems with ALL file shares as well as some domain services like unauthorized printing.

 You might try to reset the computer password using netdom.

Another thing you might look at is in Control pannel>>users>>advanced>>managed passwords, you might have a saved set of credentials that are outdated.

I have also seen Windows firewall do funky things like this.

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Cameron_SAuthor Commented:
ChiefIT,

I have tried using netdom to reset the account, but had no success. The user on the laptop is able to access all network shares, but when it comes to the My Documents folder, it is all sorts of messed up.

I tried removing the computer from the domain, deleting the computer account, renaming the computer and adding it back to the domain, but that did not change anything.

Windows Firewall is disabled, we are using Kaspersky AV for our anti-virus, and I have tried disabling the AV temporarily thinking that may have been the cause, but no success there either.
0
ChiefITCommented:
I have seen it where the computer makes two or more profiles and they can conflict.

If you open up documents and settings, how many profiles do you see for that person??
0
Cameron_SAuthor Commented:
There is only one copy of the profiles on the workstation.
0
ChiefITCommented:
I would download Fileacl.exe and figure out what is the difference on that file folders ACL. Also have that user see if they can log onto another computer and have no problems. That would isolate troubleshooting to the Vista machine.

You already tried resetting the machine password. But, have you removed this active directory user and recreated the account?

I was beginning to think this may be an incompatibility with netbios. IPversion 6, which vista comes with, is incompatible with netbios. You used netbios to map to the share within the UNC path. However, you stated that this user has no problems with other network shares. Check "My network places" to see if this computer has problems populating a list of computers and files there. That would determine if this is a netbios issue.

Windows firewall can also block kerberose as well as some communications protocols. You may be running into firewall blockage.  
0
ChiefITCommented:
Oh, good grief. I just had a thought that makes sense.

You may have managed passwords that are out of date to access this share. Go to control pannel>>users>>advanced>>managed passwords and delete all managed passwords.

If the managed passwords are out of date, you could have problems with permissions on the share.
0
Cameron_SAuthor Commented:
Well, the odd part is that it is machine specific. The user can go to another workstation and it works fine. Another Test User (Domain User) has the same issues as the user. Domain Admins have no issues on the workstation.

I have tried:
gpupdate /force
Removing the computer from the domain / readding it to the domain.
Checking managed passwords; none stored.
Turning Windows Firewall Off.

I have not deleted and recreated the profile, simply because the issue affects the test account - which tells me that it is not a profile specific issue, but rather a machine-specific issue. I will test the My Network Places next to see if that is something that is amiss. I may also try disabling IPV6 and see what happens and post the results.
0
ChiefITCommented:
Any joy Cameron?
0
Cameron_SAuthor Commented:
Unfortunately, no.

Eventually I just did a clean wipe & reload and haven't had the issue since. It was most certainly something on the computer that was causing the issue, perhaps a corrupt file that just wasn't playing nice. Couldn't peg exactly what it was though. For what it is worth, thanks for the advice though!
0
Cameron_SAuthor Commented:
Very knowledgeable, but too many variables in this problem. A good college try though! Awarding you the points since you were the most dedicated towards solving the issue.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Vista

From novice to tech pro — start learning today.