I have a network share on a file server in AD, and I have a batch file that runs on all the domain joined computers which is supposed to write a log file to the network share. However, the log files are not being written.

The batch file is a scheduled task running as System whether a user is logged in or not. The network share is configured to give Modify permissions to Domain Computers and Domain Users groups. Right clicking the folder and checking it NTFS permissions, I can verify that computers and users have modify rights. Going to the Effective Permissions tab on the folder shows Domain Computers and Domain Users can create files /write data. I don't have enough admin rights to manage the file server via Computer Management, but I can run ICACLS the see the Share settings (<MyDomain>\Domain Users:(OI)(CI)(M) and <MyDomain>\Domain Computers:(OI)(CI)(M)).

When I create CMD session as System, I can view the files in the network share. DIR works just fine, TYPE works just fine, etc. However if I try to copy a file to the share, it returns Access Denied. If I attempt to pipe the output of a batch file, it says Access Denied.

Any tips? Where should I look next?

PS - the batch file runs as desired when I log in and manually kick it off, so its not something as silly as a bad path in the batch file.

  • How is the batch file referencing the share? Drive letter? UNC path? – Ƭᴇcʜιᴇ007 May 15 '17 at 19:48
  • It is a UNC, although I did try subst z: \\fs-1\Shared` and net use z: \\fs-1\Shared` in the batch without success. – Tim May 15 '17 at 19:53
  • Have you confirmed the permissions set on the share itself (separate form the file system's security)? – Ƭᴇcʜιᴇ007 May 15 '17 at 19:56
  • I thought ICACLS checked the folder share settings as opposed to the NTFS security settings? I could be wrong though. – Tim May 15 '17 at 19:59
  • Nope, ICACLS is for setting permissions on files and folders, not shares. – Ƭᴇcʜιᴇ007 May 15 '17 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.