Link to home
Start Free TrialLog in
Avatar of LeonesIT
LeonesIT

asked on

Access-Base Enumeration ABE with Distributed File System DFS 2003 not working

Hi all, I have a Windows Server 2003 R2 server with DFS and ABE on it. I installed ABE and set the appropriate rights on the DFS share. But when normal domain users logon they can see all the shares. I checked that the users are not member of Domain Admins. I checked that the security is set the right way.

What could be the problem?

thank u
Avatar of Krzysztof Pytko
Krzysztof Pytko
Flag of Poland image

Are you sure that folder do not have listed Domain Users group?
Did you enable ABE on share?
Avatar of LeonesIT
LeonesIT

ASKER

Yes: no Domain users are listed on the folder. And ABE is enabled on the share.
So, check in advanced options of security tab in effective permissions for that user if he/she has at least read permissions.
Follow this article to hide the DFS links:
How to implement Windows Server 2003 Access-based Enumeration in a DFS environment
http://support.microsoft.com/kb/907458
nope, no read permissions for the users/group in the folder(s).
it seems that ABE is not working at all.
OK, please describe me which steps did you do.
Ok. I've got 2 DFS servers: DFS01 and DFS02. The DFS01 was the main DFS server. And DFS02 is the DFS server where all data is copied to. Because of performance issues the DFS02 server is now the main server. Everything, ABE, was already installed, configured and working. But all of the sudden not anymore.


Try to re-install ABE on DFS02. It should solve your problem. But before check event logs maybe there is something interesting (hints?)
OK, it looks like ABE was installed only on DFS01? Install it also on DFS02.
It is installed on the DFS02, when the server got installed.
OK, but where those folders are store physically (on which server DFS02)? If so, try to re-install ABE.
Found something out:

when I access the share on the DFS as follows: \\DFS02\[sharename] it works. I cannot see the folders. But when I access it through the Domain based namespace as follows: \\[domain]\[DFSnamespace] it is not working.

It seems it is a combination of DFS and ABE.
yes the folders and files are stored physically on the DFS02
Check folder content. It should be invisible. ABE hides shares and data within it. DFS namespaces are not affected by ABE at all.
I can see the folders. But I am not able to access them. The problem is that the folders are visible.

Folders are visible or DFS links?
The DFS links
So, that's the problem. You cannot enable ABE on DFS links, only on shares.

I will try to test some configuration and I will let you know in few minutes :) about results
thanks.
OK, you cannot use it for DFS links at all. I wanted to check something but it didn't solve your problem. Only shares can be used in ABE
You *can* hide the DFS links, provided you follow the instructions in the link I posted in http:#a33556597
You *will* need to set permissions on the (replicated) DFS *links* (not the DFS share), matching the DFS target, using the command line.
oBdA, your link is not working.
This link is for home folders and it works fine. Because it is the only one root from one share with many folders. But when you modify permissions on DFS links you will only receive access denied to that link, it won't be hidden :) You need the enable ABE on virtual folder's shares but I don't know how it would work :]
I can open the link just fine from this page; what exactly is the error message?
If you can access Google, search for "907458" and "Access Based Enumeration"; should be the first link showing up.
Sorry, I get it. But which CACLs command should be used then for the links?
it looks like it works, but question. Is it worth doing this? A lot of work if something would change in the environment :/

use

cacls <foldername> /t /g:<list of users and their permissions> /c
sorry <foldername> I meant <DFS link name>
ASKER CERTIFIED SOLUTION
Avatar of oBdA
oBdA

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks
Remember to document this action for future troubleshooting. You won't remember in few months that you did something like that :)