Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.
Solved
Apply changes to Active Dirctory
Posted on 2012-12-21
I have a Windows 2008 r2 server. We also have 2 terminal servers. I did changes to file permissions and had the user log off the network and then log back in.
He tells me if he access's the folder in question from his local desktop, he still cant access the folder. BUT if he logs on the the terminal server, he CAN access the folder.
What did I do wrong OR how do I force it to apply so he can also access the network folder from his local desktop.
He tells me if he access's the folder in question from his local desktop, he still cant access the folder. BUT if he logs on the the terminal server, he CAN access the folder.
What did I do wrong OR how do I force it to apply so he can also access the network folder from his local desktop.
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
5
3
- +2
11 Comments
Forgot to mention. To give this user the permissions he needs, I added him to a group in Active Directory Users and Computers
use the effective permissions option to determine actual permissions - see http://technet.microsoft.com/en-us/library/cc756795(v=ws.10).aspx
also check both the SHARE and NTFS permissions
also check both the SHARE and NTFS permissions
I think you have modified shared folder share permission to user. that is the reason he cannot access it from network.
when he access specified folder from TS session,I think he does it by opening local drives of server. so he does not need share permission for that.
if you have modify NTFS permission incorrectly, TS session also cannot access folder
so you need to modify shared folder share permission i think
when he access specified folder from TS session,I think he does it by opening local drives of server. so he does not need share permission for that.
if you have modify NTFS permission incorrectly, TS session also cannot access folder
so you need to modify shared folder share permission i think
He needs to be an ASD user and be joing to the domain for starters. After that is completed, verify his permisions are correct. Check his explidid permissions on that folder and verify he has read/write access.
On my Network-data drive the Share permissions show Everyone with full control. Then the NTFS permissions shows:
Domain Admins with full Control
Users (for our domain) with read, list and read & execute.
Then I go to the folder in question and the Group he is in has Modify, Read & Execute, List and Read
When I look at the effective permissions on that folder, that group has the correct permissions.
So I don't understand why he can't access the information from his local desktop but can from his TS desktop.
He is a user in Active Directory and is joined to our domain correctly and when I look at that folder and permissions...That group has correct permissions.
Also, as a side note: I thought in reading about permissions, that Share permissions and NTFS are independent of each other. And one approach suggested is to set share permissions to full control on everyone (which I did) and rely on NTFS permissions to restict access.
Domain Admins with full Control
Users (for our domain) with read, list and read & execute.
Then I go to the folder in question and the Group he is in has Modify, Read & Execute, List and Read
When I look at the effective permissions on that folder, that group has the correct permissions.
So I don't understand why he can't access the information from his local desktop but can from his TS desktop.
He is a user in Active Directory and is joined to our domain correctly and when I look at that folder and permissions...That group has correct permissions.
Also, as a side note: I thought in reading about permissions, that Share permissions and NTFS are independent of each other. And one approach suggested is to set share permissions to full control on everyone (which I did) and rely on NTFS permissions to restict access.
Active today
Hi.
You have to make clear if that resource is on a share of the TS or on another server. If on another server, the only possible explanation would be: the access token is assigned by a domain controller and the TS does not choose the same DC as the workstation does. So maybe the change in group membership has not replicated to that DC the workstation chooses. That would make it a replication problem.
See if the command
echo %logonserver%
produces the same result or not.
You have to make clear if that resource is on a share of the TS or on another server. If on another server, the only possible explanation would be: the access token is assigned by a domain controller and the TS does not choose the same DC as the workstation does. So maybe the change in group membership has not replicated to that DC the workstation chooses. That would make it a replication problem.
See if the command
echo %logonserver%
produces the same result or not.
Active today
Hi and merry xmas!
You still did not make clear if that resource is on a share of the TS or on another Server. Please do so.
You still did not make clear if that resource is on a share of the TS or on another Server. Please do so.
Sorry...... Got side tracked. I did the command above and as it should be, the resource is our primary domain controller. Confirmed it both locally and thru TS login. So, the share is on another server
Thinking on this. This is first time that I have set file permissions on a network. So I am trying to be very cautious.
Could this be my problem??
Let say John is a loan officer and needs modify/read/read execute on folder called LOAN
John is a member of the users group that has read and read/execute and is also a member of VP group that has modify, read and read/execute
Since he is a member of both groups will the settings for Users override settings for VP?
since they are more restrictive
Could this be my problem??
Let say John is a loan officer and needs modify/read/read execute on folder called LOAN
John is a member of the users group that has read and read/execute and is also a member of VP group that has modify, read and read/execute
Since he is a member of both groups will the settings for Users override settings for VP?
since they are more restrictive
Featured Post
Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
A hard and fast method for reducing Active Directory Administrators members.
Here's a look at newsworthy articles and community happenings during the last month.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job.
The first step is to acquire the necessary licen…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses
Course of the Month8 days, 1 hour left to enroll
715 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.