Guest Dave Durand Posted September 28, 2007 Posted September 28, 2007 Scenario... Two forests, one domain (parent only) in each forest. User accounts are in DOMAIN1 and I have some disk shares in DOMAIN2 that I'd like to grant access to. First off there is a trust between both domains. The trust isn't transitive but I'm assuming that is because neither domain has any child domains....please correct if I'm wrong. Each side of the trust is configured with Domain-wide authentication. To grant the permissions, I created a universal group on DOMAIN1 and put my users in the group. On DOMAIN2 I created a domain local group and put the universal group from DOMAIN1 into the previously created domain local group on DOMAIN2. I assigned read access at the share and file system levels for the domain local group in DOMAIN2. When my DOMAIN1 user tries to map a drive to the share in DOMAIN2 they get an access is denied message. The mapping actually runs during a login script and DOMAIN2 shows positive security events showing the user authentication from DOMAIN1 is successful. What did I do wrong? MrDurand
Guest Ryan Hanisco Posted September 29, 2007 Posted September 29, 2007 RE: Access Is Denied - HELP! Hi Dave, When not using the script, can you access the shares and files directly through browsing or UNC path. I would pull the script out of the equation to make sure that there wasn't something else causing the hassle. I would also go through again to make sure you had access to both the file and share permissions. You did mention that you did that, but it is worth checking again. If all of that checks out, I would look at when the script is loading. If the script is hitting before the profile is fully logged in (running as a machine script or synchronously with the GINA) then it may not have the token generated yet when the script tries to map. -- Ryan Hanisco MCSE, MCTS: SQL 2005, Project+ http://www.techsterity.com Chicago, IL Remember: Marking helpful answers helps everyone find the info they need quickly. "Dave Durand" wrote: > Scenario... > > Two forests, one domain (parent only) in each forest. User accounts are in > DOMAIN1 and I have some disk shares in DOMAIN2 that I'd like to grant access > to. > > First off there is a trust between both domains. The trust isn't transitive > but I'm assuming that is because neither domain has any child > domains....please correct if I'm wrong. Each side of the trust is configured > with Domain-wide authentication. > > To grant the permissions, I created a universal group on DOMAIN1 and put my > users in the group. On DOMAIN2 I created a domain local group and put the > universal group from DOMAIN1 into the previously created domain local group > on DOMAIN2. I assigned read access at the share and file system levels for > the domain local group in DOMAIN2. > > When my DOMAIN1 user tries to map a drive to the share in DOMAIN2 they get > an access is denied message. The mapping actually runs during a login script > and DOMAIN2 shows positive security events showing the user authentication > from DOMAIN1 is successful. > > What did I do wrong? > > MrDurand
Guest Dave Durand Posted September 29, 2007 Posted September 29, 2007 RE: Access Is Denied - HELP! Ryan, Just an FYI...I double and triple checked the permissions and they don't get any cleaner being by the book. Here is some additional info...the access works fine with a Windows Vista client however the Access Is Denied is showing up on the Windows XP Pro SP2 workstations only. I'm wondering if something is wrong with Kerberos or the authentication mechanism. Is there anyway for me to make sure everything is NTLM? At least that has worked for years. I'll see if the XP clients show anything in the log but the security logs on the DC in DOMAIN2 where the actual shares are located show successful authentication from the user in DOMAIN1 via the trust so I'm not sure what the problem is. Dave "Ryan Hanisco" wrote: > Hi Dave, > > When not using the script, can you access the shares and files directly > through browsing or UNC path. I would pull the script out of the equation to > make sure that there wasn't something else causing the hassle. > > I would also go through again to make sure you had access to both the file > and share permissions. You did mention that you did that, but it is worth > checking again. If all of that checks out, I would look at when the script > is loading. If the script is hitting before the profile is fully logged in > (running as a machine script or synchronously with the GINA) then it may not > have the token generated yet when the script tries to map. > -- > Ryan Hanisco > MCSE, MCTS: SQL 2005, Project+ > http://www.techsterity.com > Chicago, IL > > Remember: Marking helpful answers helps everyone find the info they need > quickly. > > > "Dave Durand" wrote: > > > Scenario... > > > > Two forests, one domain (parent only) in each forest. User accounts are in > > DOMAIN1 and I have some disk shares in DOMAIN2 that I'd like to grant access > > to. > > > > First off there is a trust between both domains. The trust isn't transitive > > but I'm assuming that is because neither domain has any child > > domains....please correct if I'm wrong. Each side of the trust is configured > > with Domain-wide authentication. > > > > To grant the permissions, I created a universal group on DOMAIN1 and put my > > users in the group. On DOMAIN2 I created a domain local group and put the > > universal group from DOMAIN1 into the previously created domain local group > > on DOMAIN2. I assigned read access at the share and file system levels for > > the domain local group in DOMAIN2. > > > > When my DOMAIN1 user tries to map a drive to the share in DOMAIN2 they get > > an access is denied message. The mapping actually runs during a login script > > and DOMAIN2 shows positive security events showing the user authentication > > from DOMAIN1 is successful. > > > > What did I do wrong? > > > > MrDurand
Guest Dave Durand Posted October 2, 2007 Posted October 2, 2007 RE: Access Is Denied - HELP! I'm thinking this is an issue with the secure channel between the workstation and domain somehow. Can anyone help me get pointed in the right direction to determine why this isn't working consistently. Now I just had a user who can't access on the Vista machine but can access on the XP machine. I can't find any consistency with this only applying to certain users or certain machines. What gives? Dave "Dave Durand" wrote: > Ryan, > > Just an FYI...I double and triple checked the permissions and they don't get > any cleaner being by the book. Here is some additional info...the access > works fine with a Windows Vista client however the Access Is Denied is > showing up on the Windows XP Pro SP2 workstations only. > > I'm wondering if something is wrong with Kerberos or the authentication > mechanism. Is there anyway for me to make sure everything is NTLM? At least > that has worked for years. > > I'll see if the XP clients show anything in the log but the security logs on > the DC in DOMAIN2 where the actual shares are located show successful > authentication from the user in DOMAIN1 via the trust so I'm not sure what > the problem is. > > Dave > > "Ryan Hanisco" wrote: > > > Hi Dave, > > > > When not using the script, can you access the shares and files directly > > through browsing or UNC path. I would pull the script out of the equation to > > make sure that there wasn't something else causing the hassle. > > > > I would also go through again to make sure you had access to both the file > > and share permissions. You did mention that you did that, but it is worth > > checking again. If all of that checks out, I would look at when the script > > is loading. If the script is hitting before the profile is fully logged in > > (running as a machine script or synchronously with the GINA) then it may not > > have the token generated yet when the script tries to map. > > -- > > Ryan Hanisco > > MCSE, MCTS: SQL 2005, Project+ > > http://www.techsterity.com > > Chicago, IL > > > > Remember: Marking helpful answers helps everyone find the info they need > > quickly. > > > > > > "Dave Durand" wrote: > > > > > Scenario... > > > > > > Two forests, one domain (parent only) in each forest. User accounts are in > > > DOMAIN1 and I have some disk shares in DOMAIN2 that I'd like to grant access > > > to. > > > > > > First off there is a trust between both domains. The trust isn't transitive > > > but I'm assuming that is because neither domain has any child > > > domains....please correct if I'm wrong. Each side of the trust is configured > > > with Domain-wide authentication. > > > > > > To grant the permissions, I created a universal group on DOMAIN1 and put my > > > users in the group. On DOMAIN2 I created a domain local group and put the > > > universal group from DOMAIN1 into the previously created domain local group > > > on DOMAIN2. I assigned read access at the share and file system levels for > > > the domain local group in DOMAIN2. > > > > > > When my DOMAIN1 user tries to map a drive to the share in DOMAIN2 they get > > > an access is denied message. The mapping actually runs during a login script > > > and DOMAIN2 shows positive security events showing the user authentication > > > from DOMAIN1 is successful. > > > > > > What did I do wrong? > > > > > > MrDurand
Recommended Posts