Windows Server 2008 R2 Unable to copy file to shared folder

Question

I have a folder on Server and have set access permissions for domain users.

Whenever a user tries to copy an image file(jpg, png, etc) to that folder, he is denied permission. But, if he copies text files or some other documents, permission is allowed.

I am trying to understand why permission is denied for image files and have enable audit policy to check for more info on why permission is denied. Below is a sample of Audit Failure log. Has someone encountered such situation earlier? Can someone help me analyze the log and determine the reason for permission being denied?

A handle to an object was requested.

Subject:
Security ID:        MyDomain\TheUser
Account Name:       TheUser
Account Domain:     MyDomain
Logon ID:       0x347740640

Object:
Object Server:      Security
Object Type:        File
Object Name:        D:\abcd\efgh\ijk\001.png
Handle ID:      0x0

Process Information:
Process ID:     0x4
Process Name:       

Access Request Information:
Transaction ID:     {00000000-0000-0000-0000-000000000000}
Accesses:       READ_CONTROL
            SYNCHRONIZE
            WriteData (or AddFile)
            AppendData (or AddSubdirectory or CreatePipeInstance)
            WriteEA
            ReadAttributes
            WriteAttributes

Access Reasons:     READ_CONTROL:   Granted by Ownership
            SYNCHRONIZE:    Granted by  D:(A;ID;0x1200ef;;;S-1-5-21-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzzz-zzzz)
            WriteData (or AddFile): Granted by  D:(A;ID;0x1200ef;;;S-1-5-21-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzzz-zzzz)
            AppendData (or AddSubdirectory or CreatePipeInstance):  Granted by  D:(A;ID;0x1200ef;;;S-1-5-21-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzzz-zzzz)
            WriteEA:    Not granted
            ReadAttributes: Granted by ACE on parent folder D:(A;OICINP;0x1200ef;;;S-1-5-21-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzzz-zzzz)
            WriteAttributes:    Not granted

Access Mask:        0x120196
Privileges Used for Access Check:   -
Restricted SID Count:   0

Answer 1

It sounds like File Screening is enabled and is blocking graphical media. File Screening is part of File Server Resource Manager for Windows Server 2008 R2 and up (I dont think it was 2k8).

File Screening allows an administrator to:

• Create file screens to control the types of files that users can save, and generate notifications when users attempt to save unauthorized files.

• Define file screening templates that can be applied to new volumes or folders and that can be used across an organization.

• Create file screening exceptions that extend the flexibility of the file screening rules.

PS - Its great in preventing people from uploading their 50GB MP3 library to your file server ;)