Windows Forum

Ask something
Discussion Locked

Profiles, shares, & permissions

0 helpful
3 replies

by johnnyextreme 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
On an NT4 Domain Controller I made a global group with users as members, then on a Win2K member server I made a local group that has the Global group as a member. I made a shared folder on the Win2K server, then gave the local group Full Control permissions for the share and NTFS permissions of Modify (everything but Full Control is checked under Advanced), and I checked 'Reset permissions on all child objects and enable propagation of inheritable permissions. One of the users was unable to access the share, receiving a "\\servername\blah is not accessible. Access is Denied" error on their NT 4 workstation, which is part of the same domain as the Win2K server. However, if they log on from any other machines in the network, regardless of OS, they are able to access the share. Other members of the global group have no problem, even when they log on at this workstation. This is only a problem on this workstation for this user. I tried Remove workstation from domain, change workstation name, add workstation back to domain - This did not work. There are no "Deny" flags set under Share Permissions or File Security. This user has the exact same group memberships as another user who is able to access the share from any workstation. I tried copying a user that could access the share, then logging on to the workstation as this new user and was able to access the share, but once I copied the profile of the old user to the new user once again Access Denied. What part of a profile on an NT machine would keep a user from accessing a share that otherwise they have permission?

3 replies

by sgt_shultz

this sure sounds like something corrupt to me. that was wonderfully explained so hope you won't be too exasperated with me if i ask to confirm: so you are looking at problem account on nt4 pdc with User Mgr for Domains...and click the 'Login To button', this problem user has 'login to all computers' checked, just like everybody else? did you try changing it to specific computer, specifically the problem server. see if login works then, then change it back? in case that fixes corruption. then i would look in *that* registry entry for problems. i am thinking with your vanilla profile test, try seeing if overwriting the user.dat file is what is causing the problem. i wonder if a file compare of those two is possible...sorry if this is dumb suggestion.

by johnnyextreme

All user's have 'login to all workstations' checked. On this workstation I copied everything from the users profile to a new folder, then deleted the profile, then created a new one by logging on as the user, then copied everything from the new folder over to the "vanilla" profile except NTUSER.DAT file and user can still access the share, so the problem is in the NTUSER.DAT file. I don't know what is stored in the NTUSER.DAT file, but the user is happy now.

This discussion is closed to new replies.