Full permissions on folder when remoted in, but read only through the network

Question

If I remote desktop into my server, I have full control over D:\MyFolder, but if I access it through explorer (\\MyServer\MyFolder), I only have read permissions, and I cannot copy in files, add folders, etc. I can do this fine if I'm remoted in.

On remote desktop, my Effective Permissions lists all the permissions, but when I do it through Explorer on my machine, it says that Windows can't calculate effective permissions for <User>

The machine is not on the same domain as my local machine, so when I log in I use MyServer\MyUser. I also use that user when looking for the effective permissions, but get that error.

Any ideas what could be causing this? Or is it going to be too specific to my setup? It's got me and my network admin stumped.

Other info: My machine is Windows 7, the server is Windows Server 2008

Answer 1

When sharing folders in Windows there are two sets of permissions you need to control.

First is the file system permissions. It sounds like you have full and/or modify access, since you are able to RDC in and modify the file system.

Secondly, there is the share level permissions. Share permissions are seperate from file and folder permissions and are set on the advanced sharing dialog.

The combination of these two permissions is what gives you your effective access of the share. The most restrictive permission takes precedence. So if you have FULL access to a folder, but the share is read only, you will only have read only access while accessing the share. The same is true in reverse; if you have full permission on the share, but are denied write access on the share, you will not be able to write to that resource.

As for your inability to calculate effective permissions, it sounds like you dont have special permissions to that folder on the advanced security setting for that folder.

Answer 2

Finally figured it out. Turns out the shared folder I was accessing it through (e.g. \\MyServer\SharedFolder) had read-only permissions on it.

Answer 3

Try mapping the drive with NET USE, using the USER parameter. Example:

NET USE Z: \\MyServer\MyFolder /USER: MyServersDomain\MyUserOnMyServersDomain

You should be prompted to provide a password. After a successful drive mapping, you will be able to access the share as Z:\.

If you get an error about multiple connections with different accounts, try disconnecting all network drives (note: this will also kill any other network share connections you currently have open) and try again.

To disconnect all network drives:

NET USE * /D

If you still can't write to the folder, check the Share permissions on the share. Note that permissions may be split into two parts: "Sharing" and "Security". When accessing the folder locally, only the permissions on the "Security" tab will apply. When accessing it remotely, both "Sharing" and "Security" will apply - the least-permissive of the two will win. So, if you have Full access on "Security", but only Read access on "Sharing", you'll be able to do whatever you want with the folder locally but you'll be restricted to read-only when accessing it remotely.

If you are an Administrator on the server, you can effectively bypass this restriciton by using the built-in administrative shares instead of folder-level shares. For your example local path of D:\MyFolder you could do this:

NET USE Z: \\MyServer\D$\MyFolder /USER: MyServersDomain\MyUserOnMyServersDomain

In some ways, doing this instead of setting up a share can be better (if everyone who needs remote access to the folder is an Administrator anyway) since you don't have to worry about messing up share permissions and accidentally allowing other people more access than you want them to have.

Answer 4

Q: Any ideas what could be causing this?

A: Yes. The Share permissions don't grant you enough access. When accessing shared folders over the network, the Share and NTFS permissions work in concert to control access to the shared folders. When accessing the folders locally, only the NTFS permissions control access to the folders.