Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a folder on Server and have set access permissions for domain users.

Whenever a user tries to copy an image file(jpg, png, etc) to that folder, he is denied permission. But, if he copies text files or some other documents, permission is allowed.

I am trying to understand why permission is denied for image files and have enable audit policy to check for more info on why permission is denied. Below is a sample of Audit Failure log. Has someone encountered such situation earlier? Can someone help me analyze the log and determine the reason for permission being denied?

A handle to an object was requested.

Subject:
Security ID:        MyDomain\TheUser
Account Name:       TheUser
Account Domain:     MyDomain
Logon ID:       0x347740640

Object:
Object Server:      Security
Object Type:        File
Object Name:        D:\abcd\efgh\ijk\001.png
Handle ID:      0x0

Process Information:
Process ID:     0x4
Process Name:       

Access Request Information:
Transaction ID:     {00000000-0000-0000-0000-000000000000}
Accesses:       READ_CONTROL
            SYNCHRONIZE
            WriteData (or AddFile)
            AppendData (or AddSubdirectory or CreatePipeInstance)
            WriteEA
            ReadAttributes
            WriteAttributes

Access Reasons:     READ_CONTROL:   Granted by Ownership
            SYNCHRONIZE:    Granted by  D:(A;ID;0x1200ef;;;S-1-5-21-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzzz-zzzz)
            WriteData (or AddFile): Granted by  D:(A;ID;0x1200ef;;;S-1-5-21-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzzz-zzzz)
            AppendData (or AddSubdirectory or CreatePipeInstance):  Granted by  D:(A;ID;0x1200ef;;;S-1-5-21-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzzz-zzzz)
            WriteEA:    Not granted
            ReadAttributes: Granted by ACE on parent folder D:(A;OICINP;0x1200ef;;;S-1-5-21-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzzz-zzzz)
            WriteAttributes:    Not granted

Access Mask:        0x120196
Privileges Used for Access Check:   -
Restricted SID Count:   0
share|improve this question
    
What is the exact error they get when trying to copy the image(s)? How big are the images? And disk quotas setup for the user? If you make a new share with the desired/expected permissions, does copying there work? –  Ƭᴇcʜιᴇ007 Aug 7 '13 at 13:35
    
Error Message: Access Denied(using cmd) Images are about 2 MB in size. There are no disk quotas. It works for another folder we have shared, but, there are not visible differences in permissions. Moreover, it allows copying for some files and just denies some others. –  Piyush B Aug 8 '13 at 4:53
    
Anyone facing this issue ? –  Piyush B Aug 9 '13 at 5:18

1 Answer 1

It sounds like File Screening is enabled and is blocking graphical media. File Screening is part of File Server Resource Manager for Windows Server 2008 R2 and up (I dont think it was 2k8).

File Screening allows an administrator to:

  • Create file screens to control the types of files that users can save, and generate notifications when users attempt to save unauthorized files.

  • Define file screening templates that can be applied to new volumes or folders and that can be used across an organization.

  • Create file screening exceptions that extend the flexibility of the file screening rules.

PS - Its great in preventing people from uploading their 50GB MP3 library to your file server ;)

share|improve this answer
1  
Slick, that's a new one to me. :) –  Ƭᴇcʜιᴇ007 Aug 7 '13 at 13:40
    
Yeah, but it's too bad that it can be circumvented by changing the extension on your MP3 to .doc. –  Jack Aug 7 '13 at 19:38
    
Hi Keltairi, Its not enabled. –  Piyush B Aug 8 '13 at 5:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.