6

I have a computer with Windows Server 2008 ("R1") SP2, which I use as a home server, and another with Windows 8.1 ("Home"), which I use daily. There is no domain controller in the network. I'm logged at Windows 8.1 with user A, let's call it PC\AUser. There is no user A at the server. I have a shared folder to the user B, let's call it SERVER\BUser.

How can I force to Windows 8.1 ask for credentials when I go to start -> run \SERVER\SharedFolder\ ?

For now I only receive this error: "You do not have permission to access \SERVER\SharedFolder. contact your network administrator to request access."

I've been able to share the folder unprotected, by adding "Everyone" to the permission list. But as soon as I remove "Everyone", the Windows 8 client simply says "you do not have permissions to access this folder", without asking for any credential.

I've already done it in the 2000 and XP days...

How to force the prompt for credentials in Windows 8.1?

Update:

I've accessed it from a Linux client with the command:

smbclient //SERVER/SharedFolder mypassword -U BUser

So this shifts the problem into the Windows 8.1 client - the server is configured OK.

Update 2:

On request, this is the error message I receive. It's in portuguese, but experienced users will recognize the window. It says "Title: Network Error. Windows couldn't access [folder]. You don't have permission to access [address]. Contact the network administrator to request access permission."

error message.

Update 3:

I have been able to connect to the share by using the "map network drive..." option and manually setting credentials there - but first I had to un-map the share using net use /delete because it seems Windows creates a stale mapping on the failed connection attempt (wtf?). This way, it is at least usable for me now. But will give the bounty reward if someone can solve or explain the issue of Windows 8.1 failing to connect with a permissions error instead of asking for credentials.

Final Update:

Found the solution! I've posted it as an answer.

4 Answers 4

3
+50

The poster has found that after disabling the Guest account, Windows demanded a credential. I thought it important to add an explanation of this behavior (quoted from this source), that changed completely from after XP and starting with Vista.

Windows XP introduced a concept called Simple File Sharing that, when enabled, entirely eliminated security for file sharing. All network access was done in the context of the Guest user account, regardless of the remote user's actual account name. Essentially. anyone with physical access to your network could access any shared file. This made it much easier for other people in your home and office to get to each other's files.

Windows 8, 7, and Vista also include Simple File Sharing, although it's now called Password Protected Sharing. And, the effect of disabling and enabling the feature is reversed on the two newer operating systems.

image

This setting is not always changeable. In Windows XP Home Edition, Simple File Sharing is always checked and cannot be turned off. In all other versions of Windows, it can be turned on or off, except if the computer is a member of a domain network. In this case, passwords are always required.

Finally. Windows 8 and 7 have a new twist in the way that security works when Password Protected Sharing is turned off. On Vista and XP, when passwords are not required, all incoming network access uses the Guest account. Thus, anyone on the network can access any file in a shared folder if the file can be accessed by the user account Guest or by the user group Everyone.

But on Windows 8 and 7, the following happens when a remote user attempts to use a folder or file shared by a Windows 8 or 7 computer with Password Protected Sharing turned off:

  • If the remote user's account matches an account in the Windows 8 or 7 sharing computer and that account has a password set, that account is used for file access
  • If the remote user's account matches an account in the sharing computer but that account has no password set, then the Guest account is used.
  • If the remote user's account matches no account in the sharing computer, the Guest account is used.

This might seem convoluted, but it is actually a very useful change. First of all, this change was necessary to support the new HomeGroup feature. All homegroup member computers use a special, password-protected account named HomeGroupUser$ to access other member computers, and this change lets it work whether Password Protected Sharing is turned on or off. Second, it gives you the option of giving designated users additional access privileges, without requiring you to set up a full-blown security scheme.

3
  • Password protected sharing is disabled on my server now because if I enable it, I get other error message when trying to access the share, worth of another superuser question... Does that mean that all my shares are exposed to anyone or only those that I explicitly give permissions to "Everyone"? Mar 4, 2014 at 13:14
  • Nevermind, password protected sharing is enabled on my server, please ignore my previous comment. When it is disabled that I get nasty errors, but probably because there is no matching account there AND Guest is disabled. Thanks for the thorough explanation, it is worth a reward ;) You dug a book reference, it seems this is a peculiar issue I stepped on. Mar 4, 2014 at 13:36
  • This problem is particularly difficult to analyze for persons having experience with XP, since Microsoft went and changed everything in Windows Vista. I also learned from your experience.
    – harrymc
    Mar 4, 2014 at 13:44
3

This was not the answer that worked for this post (see my other answer), but it might work for other people in different situations, so there is no point in down-voting.

You may have already used some credential when connecting which doesn't have the necessary permissions, or that had them once and now doesn't any more. Windows will insist on using that useless credential for every connection, resulting in a really nice gotcha.

To make Windows forget that credential :

  1. Go to Control Panel > User Accounts > Manage your credentials
  2. Examine the list of credentials under Windows Credentials
  3. Click on the down-arrow to the right of a credential for details
  4. Click Remove from vault to delete.
  5. In a Command Prompt that is Run as Administrator, enter net use * /DELETE.
    (This will delete the credentials for all network shares.)
9
  • Tried removing all the credentials for the machine I am connecting to. No deal :( Mar 2, 2014 at 20:08
  • I saw you included item 5 with the net use command. Tried it, no result too. I managed to connect to the share by mapping it to a drive Letter; but using the Run dialog, it still gives the error Mar 2, 2014 at 20:41
  • Ah yes, I added above the last and missing step that could have saved you mapping the drive. I believe that my explanation above is correct: Windows caches useless credentials. The mapping trick you found apparently tricks it into asking again for the credential, but remembers it afterward. Windows is full of this kind of inconsistencies.
    – harrymc
    Mar 2, 2014 at 20:41
  • Did you use net use * /DELETE or net use {share-name} /DELETE?
    – harrymc
    Mar 3, 2014 at 12:55
  • Both of them... Mar 3, 2014 at 18:33
2

Access to the share is user-based, not password-based.

The most simple way to achieve a basic protection for your share is to:

  1. create a password-protected user account on your server,
  2. assign to this user the necessary rights to the share (just as it was assigned to Everyone group),
  3. make sure that same user also have necessary rights on filesystem-level (this are separate from share rights, yet both are required).

Afterwards, use the that user's login and password when accessing the share.

9
  • I've assigned permission to the Administrator user on the server, but the client does not ask for any password; it simply fails with access denied. Do I need to create a non-Admin account for this? Feb 27, 2014 at 1:10
  • No deal. Created an user account, assigned filesystem AND share permissions to it. Windows 8 says I do not have permission. Of course I do not have permission - it didn't ask for any user and password! Mar 1, 2014 at 10:52
  • Re-worded the question completely. Take a look. Mar 1, 2014 at 11:18
  • Could you post an exact text or screen of error message? Mar 1, 2014 at 14:38
  • I've updated the question with the error screen on the question. Take alook. Mar 2, 2014 at 20:04
2

Okay, Guys, I beat you all to it. :)

Fiddling with the server, I decided to check the "Sessions", under Shared Folders in Computer Management.

  • Surprise, my Windows 8.1 computer was connecting with a Guest account!

guest session

  • Then, I proceeded to disable the Guest account:

disabling guest account

  • Close the Guest session shown above

  • Aaand... upon connecting to the share via Windows -> Run

credentials prompt

Success!

1
  • 1
    I have added another answer that explains this behavior, for future readers.
    – harrymc
    Mar 4, 2014 at 7:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .