Non-Domain User access File Share on a Domain Computer


Recommended Posts

I have a Windows 2003 Server, Standard Edition (SP1) running Active Directory which is the only server in the network.

I also have a Windows XP Professional (SP2) client that is a Domain Member, which has a Local User ("Non-Domain User").

I need the Local User on the Windows XP client to have access a file share on the Windows 2003 server. When the Local User tried to connect to the server, they are prompted for a username/password of a Domain User to get access.

I have tried setting the Sharing permissions on the shared folder to allow access to Guests, Domain Guests, Domain Computers, Everyone and ANONYMOUS LOGON. I have also set those groups File System permissions to compliment the Share Permissions.

No luck. I think that the reason why that didn't work is because the Server is prompting for Authentication before it even lists the available File Shares, not after I try to access the Shared Folder that I'm trying to share, therefore the permissions of the individual file shares make no difference.

I would prefer to do this with a seemless method that doesn't not require the Local User to save a password in the Passwords List or have to Add new Domain Accounts to the server.

All help recieved will be appriciated.

Thanks,

Quick Reply

Hmm sounds like a good workaround, I could set up a new Domain User that only has permissions to access the file share. I'll see how it goes.

If there are a way to configure the server permissions itself than I would prefer that... I'm only doing this on one Test Machine now, but soon I will roll out access to the file shares across the whole network, and I don't have access to all of the machines (Some workers have their own laptops). The users themselves would have to set this up which could be trouble.

  Quick Reply said:
Hmm sounds like a good workaround, I could set up a new Domain User that only has permissions to access the file share. I'll see how it goes.

If there are a way to configure the server permissions itself than I would prefer that... I'm only doing this on one Test Machine now, but soon I will roll out access to the file shares across the whole network, and I don't have access to all of the machines (Some workers have their own laptops). The users themselves would have to set this up which could be trouble.

586019444[/snapback]

Lets say you have the following share: \\TESTSERVER\testshare1

Now create an AD user (for instance testshare1_user), and give it the necessary NTFS permissions on Testshare1.

Now if anyone wants to connect to this share, go to \\TESTSERVER\testshare1 and they will be prompted for username/password.

They will have to use as username domainname\testshare1_user and its correct password.

The trick is to add your domainname followed by a backslash before entering the username. That way, the computer who tries to access your testshare1 knows that the credentials for accessing this share are on the domain controller. Otherwise the computer tries to find these credentials on the local computer where they don't exist off course.

This way you create an AD user for each share you want to make accessible for non-domain PCs. And they always connect to \\TESTSERVER\sharename with username DOMAINNAME\USERNAME and it's correct password.

  MazX_Napalm said:
Computer needs to be part of the domain, even though it doesn't log on to the domain.

586019644[/snapback]

This is not correct, you can connect to domain resources from any computer. You only need a domain username and password.

  ChocIST said:
Why cant you just enter a valid UN and PW for the domain to access it?

ChocIST

586020903[/snapback]

Well, that's what I said right? Just make sure that user has rights on the share. And take into account that you need to logon with domain\username and not just with username.

  MazX_Napalm said:
Computer needs to be part of the domain, even though it doesn't log on to the domain.

586019644[/snapback]

  Komakino[BE] said:
The trick is to add your domainname followed by a backslash before entering the username.

586020611[/snapback]

  ChocIST said:
Why cant you just enter a valid UN and PW for the domain to access it?

586020903[/snapback]

The computer is already part of the domain, just not the user.

I have been using the backslash when entering usernames.

The problem is that the end users that I am dealing with can not cope with change and already struggle with their basic skills to do basic tasks.

What's mor eis that when I enter the username/password of the Domain User when connecting to a Domain Resource, The password isn't saved after being rebooted.

And also, I need to share a printer after I get the File Shares working. And a username/password for a file share hasn't been entered between logging on and trying to print something, the printing job will fail and NOT prompt for a username/password due to some bug in Windows XP that doesn't ask for it when it should. There is no way I can think of to get the users to deal with that when they just want to print a word document.

Thanks for the workarounds, but they don't work very well, I just want a server-side solution. :woot:

Dude - why exactly is this not a domain user? You state the machine is a member, you want to give access to some share's to this user, plus printer(s)..

Why would this user NOT be using a domain account?

All of your issues go way - just have the user log into the domain.. All your problems solved! The user does NOT have to be member of domain users, so they could be limited to only access specific shares, etc. They could be give whatever permissions they need on the local machine, etc.. etc..

For the life me I can not see why you would NOT have this user log in with domain account??

Most of the computers I want to allow shares to are laptops, How are the users supposed to log in if they are out and about, not connected to the network, or the domain server were to go down? The Domain Server itself is still under testing and constant reconfiguration, if the server needs to have AD reinstalled, nobody would be able to log on until I set everything up again and rejoin each laptop to the domain. The test machine is only a member of the domain for testing, when I set the laptops up, they arn't going to be domain members.

Surely there is a Group Policy or Security Policy seting that I can make, simular to "Let Everyone permissions apply for ANONYMOUS LOGON" which doesn't seem to work.

  Quick Reply said:
Most of the computers I want to allow shares to are laptops, How are the users supposed to log in if they are out and about, not connected to the network, or the domain server were to go down?

586028525[/snapback]

So long as the user has logged into that machine while it was connected to the domain, they can log into that machine while it is not connected to the domain.

Basically that user just needs a profile folder in the Documents and Settings folder.

  Quick Reply said:
when I set the laptops up, they arn't going to be domain members.

586028525[/snapback]

Why? What is the point of your domain then?? If your not going to have any members?

Your laptops will login from cache, if they are not on the network - or DC is not available.. So will every other machince - unless you have turned disabled login from cache..

As to access to ANON or ANYONE - as already stated, turn on the guest account.. This is its purpose..

Another method to map a drive without the user having to do anything.. since your saying /savecred is not working, would be to create a simple batch file.. put it on the computer to run when they login

NET USE *\\computername\sharename /user:domainname\username password

Or give them an shortcut to it on their desktop.. click and they have access to whatever share they need with whatever account they need to use, etc..

But if your going to have all your laptops as local accounts - what exactly is the POINT of your domain? Peer to Peer network with a 2k3 box in the middle is what you have ;)

  Quick Reply said:
Most of the computers I want to allow shares to are laptops, How are the users supposed to log in if they are out and about

586028525[/snapback]

Uh, every laptop user that I have in the domain works 4 days or more away from the office. Not one of them has complained that they can't log on to their laptop using their domain accounts.

To solve your problem, create a user called user1 and give it a password of password.

Give this user full access to the share.

Instruct the users to Start, Run, \\server\share. They will be be asked for a username and password.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • If you're stupid enough to try and get one, each and every headache along the way is on you. I can only hope that these roadblocks on a pre-order are enough to dissuade people.
    • "You should have a Microsoft Account because we can help keep your data safe...until we can't." As an IT guy I know that I should never put my trust in one backup solution if the data is important. But for non-IT people, they are getting tricked into Microsoft's practices with falsehoods.
    • it is delayed and has no definitive release date... that is "delayed indefinitely".
    • About that Trump's mobile 🤣🤣🤣  
    • AliExpress faces EU crackdown, makes promises to fight illegal products by Paul Hill The European Commission has taken two significant actions against the Chinese online marketplace AliExpress under the Digital Services Act (DSA) in a bid to enhance user and consumer safety online. The first action was to get AliExpress to commit to several legally binding commitments to address issues related to advertising and recommender systems. The second action was the publication of preliminary findings which found that AliExpress had breached obligations regarding the spread of illegal products. AliExpress can now respond to the Commission but if the broken rules are confirmed then AliExpress can expect to be fined. The Digital Services Act is a new tool that the EU has to regulate large online platforms. It aims to level the business playing field, protect fundamental rights of users, create a safer digital space, and improve transparency from businesses. AliExpress's pledges: More transparency, safer shopping As part of the pledges made by AliExpress, it will do more to monitor and detect illegal products such as medicines, food supplements, and adult material propagated through hidden links and affiliate programs. To help flag illegal items, AliExpress has promised to improve its notice and action mechanism. Other pledges include enhancements to the internal complaint handling system; more transparency for advertising and recommender systems; better traceability of traders on the platform; and improved data access for researchers. By implementing these rules, the European Commission hopes it can make AliExpress safer for registered and non-registered users by limiting the exposure to illegal content. Deep dive into AliExpress's alleged failures With regards to the preliminary findings, the Commission found that AliExpress had underestimated the risks because it had not allocated enough resources to moderation systems for illegal products. It also found that the company had failed to consistently enforce its penalty policy against those publishing illegal content. The Commission also discovered systemic failures in AliExpress’s proactive content moderation systems that allowed malicious traders to continue to operate or start operating on the platform. AliExpress is designated as a Very Large Online Platform (VLOP) which means it has to meet certain standards set out by the EU. The aforementioned violations are against the quality of operation that the EU expects from VLOPs. The company now has the right to defend itself against the EC’s findings, it can examine the documents and reply in writing, but if the findings are confirmed, AliExpress could face fines and be required to submit an action plan.
  • Recent Achievements

    • Week One Done
      TBithoney earned a badge
      Week One Done
    • First Post
      xuxlix earned a badge
      First Post
    • First Post
      Tomek Święcicki earned a badge
      First Post
    • One Year In
      carlitin86 earned a badge
      One Year In
    • Reacting Well
      Peterlll06 earned a badge
      Reacting Well
  • Popular Contributors

    1. 1
      +primortal
      674
    2. 2
      ATLien_0
      283
    3. 3
      Michael Scrip
      226
    4. 4
      +FloatingFatMan
      192
    5. 5
      Steven P.
      145
  • Tell a friend

    Love Neowin? Tell a friend!