Windows Forum

Ask something
Discussion Locked

NT Workstation Security Problem

0 helpful
14 replies

by ruloth

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have an NT 4.0 Workstation running NTFS and is on SP6. After joing the domain the PC will not allow domain users to access the local drive. Users with Domain Admin permissions have no problem accessing the PC. All the directory and file permissions are standard from the NT installation. The only way I can allow the Domain users to use the PC is by making them a member of local administrators group on the PC.

Any ideas would be appreciated!

14 replies

by shmaltz

Make sure that you did not give anyone the No Access permission as this permission overrides any other permission.

by ruloth

Appreicate the reply.

As I stated in the message the permissions are the NT defaults. On the C Drive the share is the default(Everyone). The NTFS permissions are also the default(Everyone). This is the same for the WINNT directory.

by don christner

Within each user you can allow them to logon to certain computers or all computers. Make sure that the users are allowed to logon to all computers, or at least the computer in question. This is stored on the server, not the local perms.

Don

by ruloth

All users within our environment are able to logon to any workstation. This was one of the first items I had double checked. Just before replying to this message I went and changed all the permissions on the c drive and sub directories for "Everyone" to have full control. It did not make a difference. After the domain user logs on he/she is prompted for a user name and password to access c$.

by allan

Are you running "System Policies" ?
If so, the problem may be there.
Otherwise you need to change the permissions for the "Right to Log on Locally"

by ruloth

I'm not running system policies but I did check the Account Policy. Something I hadn't thought of. Checking the permissions. My setting indicated that Domain Users have the right to log on locally. ( For a minute I thought you had it!!)

by m_galvin

If you are using DHCP reserve that workstation's IP address with a bogus Unique Idenitfier, then release and renew the workstation.

by ruloth

We are using DHCP. I made the changes that you suggested. There was no difference.

by nicko

Sorry, could you please clarify:
are the users sitting at this workstation when you say they log on to it or they connecting remotely to a share?

Have you excplicitly shared out c to everyone or are you using the default c$ share?

by ruloth

The users are sitting down at the machine. The share that is being used is the default c$ share. I hve not changed any of the NT setting since the install

by ewing bettles

I've had similar problems in the past when using "imaged" workstations. Even when the computer name and SID's have been changed, shortcuts have embedded UNC information that still points to the original workstation name. If that original workstation name still exists on the network, each time a link is accessed it resolves to the original computer name UNC path, and the normal domain user doesn't have local administrator privaleges necessary to access the c$ share of that original machine.

Two ways to fix this:
1. Find the original computer name and remove it from the network. When the link resolution is attempted, the O/S will first try the original UNC path, if this isn't available a local path will be substituted - permanently. Downside is timeout period required for each different link.

2. If network shortcut resolution isn't a biggie, please follow the information provided in Microsoft's Technet KB article Q158682 to add a Registry value to HKEY_LOCAL_MACHINE subtree. The entry, LinkResolveIgnoreLinkInfo, its value and exact location are fully explained within the article.

Hope this helps, -Ewing

by ruloth

The issue was resolved with the article Q158682. It however does not resolve similar issues on a Windows 2000 desktop.

Thanks.

This discussion is closed to new replies.