Networks

Ask something
Discussion Locked

Domain share permissions

0 helpful
7 replies

by mike_m 3 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi.
- NT4.0SP6 server
- 20 WS, mixed NT4 and W2000 logged as domain
- On server I have user groups (not localgroups)
- On WS shared folder have different permissions (localgroups)
- When attempting to access file X on WS Y from WS Z (all participating to domain) grant is given according to local privilidges on compuiter Z, regardless of "Share Permissions" on Server Manager on PDC.
- Also maximum access is limited to 5, as in shared WS not participating to domains.

What am I foreseeing? Should I clear all permissions and recreate evrything under PDC?
Or should I always set local permissions to "everybody Full control" to let server grant domain permissions?
Can anybody help? Thanks, Mike

7 replies

by erikdr

WS sharing happens according to the workgroup model, not the domain model. No matter whether the WS itself is in a domain or not.
You _can_ assign NTFS permissions on C: to domain accounts, but they are only valid if that user logs on with his account locally to this WS. If the user accesses the WS share from another WS, I'm afraid they don't really use the domain credentials as these cannot be validated by the local SAM. So grant to WS Y is given according to local privileges _on computer Y_,I cannot imagine that the rights on computer Z have anything to do with this.

So as long as you want to share anything on the WS (instead of putting all shared resources on servers, as MS advocates) you are stuck with workgroup security also. Notnice to manage, and indeed also with 5 or 10 concurrent sessions max...

At your service,

- The Netherlands

by mike_m

Still not fully convinced. It seems too tricky. I think that if I access a domain from computer xxxx I shoul have "MY" privileges anywhere on the domain, as granted by domain server. More, if this is not the case, why shlould "server manager" let you remotely set "clients" share properties and security? Somebody told me this can be done on W2000 server. Will check again, then will gran you the question. Thanks. Mike

by mike_m

Thanks, but I am not shure if we are correctly interpretating.
By WS I mean stations with WS NT OS, identified and participating to the server domain.
If I cannot use the domain for permnission grant, why does the server manager give me the possibility to set permissions on logged computers, and I do I use the option NETWORK/name versus COMPUTER/name or just name to grant permission ? Also it seems to work fine using predefined groups like NETWORK and AUTENTICATED USERS, but does not grant access to newly defined groups.
Also, is there any problem in authenticating users from NT 40 to access W2k stations ?
Thank you. I will increase the rating for this type of questions. Mike

by shanghai sam

I suggest you to define global groups (created on PDC) and users login only on domain.
Once you have these groups you can define anywhere a share with permissions based on these groups or by individual domain accounts. You can manage all shares from PDC or from your workstation with Domain Admin rights. By default the number of users on a share is maximum allowed (>>5). I misunderstand why you need the local groups on WS (in our network ? 100 WS - only Administrator and Domain Admin can logon locally. It?s very good for preventing unauthorized or bad interventions on WS settings/shares/etc).

This discussion is closed to new replies.