On an NT4 Domain Controller I made a global group with users as members, then on a Win2K member server I made a local group that has the Global group as a member. I made a shared folder on the Win2K server, then gave the local group Full Control permissions for the share and NTFS permissions of Modify (everything but Full Control is checked under Advanced), and I checked ‘Reset permissions on all child objects and enable propagation of inheritable permissions. One of the users was unable to access the share, receiving a “\\servername\blah is not accessible. Access is Denied” error on their NT 4 workstation, which is part of the same domain as the Win2K server. However, if they log on from any other machines in the network, regardless of OS, they are able to access the share. Other members of the global group have no problem, even when they log on at this workstation. This is only a problem on this workstation for this user. I tried Remove workstation from domain, change workstation name, add workstation back to domain – This did not work. There are no “Deny” flags set under Share Permissions or File Security. This user has the exact same group memberships as another user who is able to access the share from any workstation. I tried copying a user that could access the share, then logging on to the workstation as this new user and was able to access the share, but once I copied the profile of the old user to the new user once again Access Denied. What part of a profile on an NT machine would keep a user from accessing a share that otherwise they have permission?