Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Active Directory Folder security change

Posted on 2014-02-26
9
169 Views
Last Modified: 2014-03-12
Setup a new folder with security rights for only specific individuals.

For one of the allowed users he cannot access the folder on his current workstation, but if the he logs into another workstation or into Terminal Services server session, he can access the folder and has all the rights he should have. It is just on his personal workstation that he cannot access the folder.

Rebooted, logged him back in and still no access.
0
Comment
  • 5
  • 2
  • 2
9 Comments
 
LVL 70

Expert Comment

by:KCTS
ID: 39890471
Sounds like an issue with the SHARE permissions - check these as well as NTFS
0
 

Author Comment

by:haradaindustryofamerica
ID: 39890489
I see no issues with either. He can log into any other machine on our network and access the folder fine, only his machine has problem accessing.
0
 
LVL 70

Expert Comment

by:KCTS
ID: 39890504
Check that the computer in question is authenticating to the network OK. It may have an issue and is logging on the user using cached credentials.
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
LVL 36

Expert Comment

by:Mahesh
ID: 39893069
just remove affected machine from domain once and re-join to domain and try

On affected computer please open Advanced Tcp/IP settings and check DNS Tab.
In DNS tab, check below settings.
ensure that "Append Primary and connection specific dns suffixes" radio button is selected
Ensure that "Append parent suffixes of primary dns suffix" checkbox is selected
Ensure that "register this connection addresses in Dns" checkbox is selected
If there is any deviation in the above settings, its probably you will face name resolution and network access issues

Mahesh
0
 

Author Comment

by:haradaindustryofamerica
ID: 39900751
Mahesh -

Tried removing and adding back to domain, still has issue.

All the settings you referenced above were set already.

We had another user in his department with the same access rights as him log into his machine, they can access the folder fine. This is very weird.
0
 

Author Comment

by:haradaindustryofamerica
ID: 39907680
Does anyone have any other ideas?

Thanks in advance.
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 39908541
Run rsop.msc on the affected machine and check if any specific policy denying that machine from accessing network shares ?
Also check if you can access any other share folders on other servers from this machine ?

Also check if you can access netlogon and sysvol share folders on domain controllers

Go to run and enter %logonserver%
This should resolve to NetBIOS name of its local authenticating DC
if here you get error or it resolves to another site DC, most probably u need to resolve this issue 1st
Check that machine subnet to site mapping is correct

Also run below test on Machine to check its domain secure channel is correct

With netdom utility
You can reset the secure channel from the command prompt with the Netdom command as follows :
netdom reset machinename /domain:domainname
replace machinename with your computer name and domainname with your domain name
You can run this command on machinename itself, or from any other computer or domain controller as long as you are logged in with an account that has admin priviledges to the machinename computer.

The following command tests the secure channel for a computer with nltest utility
nltest /server:<ComputerName> /sc_query:<DomainName>
The following command resets the secure channel for a computer:
nltest /server:<ComputerName> /sc_reset:<DomainName>

To reset the SC between a computer and a DC with Powershell
Open PowerShell on the computer and run
Test-ComputerSecureChannel -repair

*The cmdlet requires PowerShell 2.0, which is pre-installed on Win7/2008R2.

Reboot machine once post resetting secure channel by any method above and check if it works

If still you are facing issues, I don't see any good option other than formatting machine and rebuilding OS since issue exists with single machine.
In that case you should not alter any server side settings

Mahesh
0
 

Accepted Solution

by:
haradaindustryofamerica earned 0 total points
ID: 39912444
Mahesh,

Thank you for your assistance but everything you listed above was fine.

we actually resolved it ourselves, we simply created a new folder with a different name, setup all the shares for that folder, tested the access and it worked fine for all users including the user we were having difficulties with.

Then we deleted the other folder giving us issues with the one user and renamed the good working folder to the name of the folder deleted. Everything is working fine. Still odd though.

Thanks again.
0
 

Author Closing Comment

by:haradaindustryofamerica
ID: 39922893
We discovered the solution on our own, see previous posted comment.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Mapping Drives using Group policy preferences Are you still using old scripts to map your network drives if so this article will show you how to get away for old scripts and move toward Group Policy Preference for mapping them. First things f…
Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question