up vote 2 down vote favorite
share [g+] share [fb]

I am on a home network and not using a domain controller. My username is in the administrators group and I have UAC turned on. I have a share on a network computer that has certain rights for users of the administrators group (the group itself has permissions). However, I find that it is not honoring those permissions, but have to explicitly add my username to this ACL in order to have access.

Why won't this work, since both usernames are under an administrators group? Does this not matter the group when accessing a remote share or does it only authenticate at the user level? Thanks.

link|improve this question
92% accept rate
here you go my friend, think-like-a-computer.com/2011/05/11/… – AJ123 Apr 6 at 15:02
feedback

2 Answers

up vote 1 down vote accepted

The most restrictive permissions are followed. So if there is a denied for your account, but allowed for administrators, you will be denied.

link|improve this answer
What if a "Users" group was on the same list, but with lesser permissions. Would it follow the Users' permissions first? – Ryan Peters Jun 12 '11 at 23:12
It follows the most restrictive. – soandos Jun 12 '11 at 23:14
Right, so you're saying it is seeing my (remote) user as part of the Users group rather than the Administrators group? – Ryan Peters Jun 12 '11 at 23:23
Check what groups your user is a member of. – soandos Jun 12 '11 at 23:23
The user is in the administrators group. – Ryan Peters Jun 13 '11 at 1:47
show 1 more comment
feedback
up vote 0 down vote

You need several things:

  1. Since it is not a domain, and thus not really one user, you need the user AND password to be the same on both computers. This allows for pass-through authentication.
  2. You need to set the Share's permissions to allow access, usually full for the administrator, and do it not for the administrator's group. I suspect this is where you are failing since the administrator on computer 1 is not really in the administrator's group on computer 2 since they are different users.
  3. You need to set the security permissions on the files. Again, I would set these permissions for the individual administrator user.

As noted by soandos, the most restrictive permissions will apply, so if you only have read on the share permissions, it will not matter if you have full control on the security permissions.

link|improve this answer
To make sure I understand what you're saying. Yes, setting the security (I have the share all set up as needed) for the administrators group will not work, but rather it MUST be set per individual user (also, I do have matching user accounts on both machines). – Ryan Peters Jun 12 '11 at 23:14
I am used to working in domains, but it seems to me that since the only way this works is pass-through authentication, meaning both username and password have to match, how can you do that with groups since they have no passwords regardless of membership. – KCotreau Jun 12 '11 at 23:41
Let me also add that it follow the most restrictive between the share and security permissions. If you have a user, who is an admin and has full permissions, but also a member of the users group and has limited permissions, and we are talking security permissions, that person has full permissions. If you added only read permissions for the share, even an admin would be limited to read permissions. – KCotreau Jun 12 '11 at 23:45
The exception is a deny permission...that overrides all. – KCotreau Jun 12 '11 at 23:46
Both users have the same username/password. Both are in the administrators' group. However, I cannot access with full permissions for the Administrators group. It seems like it's not seeing the account as being part of this group. Is this true or is something messed up? – Ryan Peters Jun 13 '11 at 1:09
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.