Unable to access domain shares from a non domain computer

[Joe Thomas]

Hi,

We have a domain controller that is also a file server running W2k3 SP1.
There are shares defined on this machine. All machines that are connected to
the domain can access the shares without problem. We have some machines that
are not allowed to join the domain. However I need users who have domain
accounts to be able access their shares from this non domain machine. Can I
access the domain shares from a XP Pro SP2 machine that is not connected to
the domain using valid domain accounts?

When I key in \\filesvr_computer\share_folder as the address in Windows
explorer on the non-domain computer I get a username and password prompt. I
use a valid domain account username and password of the form
"domainname\username" and the domain password, the prompt appears a second
time. When I key in the same info again it comes out with a "Windows cannot
find "\\filesvr_computer\share_folder". Check the spelling ... " prompt. The
share pathname and user information is surely correct. When I checked the
filesvr_computer's Event security log I get a event id 533, saying "User not
allowed to logon at this computer". Since the file server is also a Domain
controller we don't not want users to logon locally on the domain controller.
How can I get domain shares to be accessible on a non-domain computer using
valid domain authentication?

Thanks.

Joe
--------------

[Robert L [MS-MVP]]

That should work. Try the administrator account. Can you access it?

Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
"Joe Thomas" <JoeThomas@discussions.microsoft.com> wrote in message news:94023592-B303-4C5F-B777-D6BBADA10230@microsoft.com...
Hi,

We have a domain controller that is also a file server running W2k3 SP1.
There are shares defined on this machine. All machines that are connected to
the domain can access the shares without problem. We have some machines that
are not allowed to join the domain. However I need users who have domain
accounts to be able access their shares from this non domain machine. Can I
access the domain shares from a XP Pro SP2 machine that is not connected to
the domain using valid domain accounts?

When I key in \\filesvr_computer\share_folder as the address in Windows
explorer on the non-domain computer I get a username and password prompt. I
use a valid domain account username and password of the form
"domainname\username" and the domain password, the prompt appears a second
time. When I key in the same info again it comes out with a "Windows cannot
find "\\filesvr_computer\share_folder". Check the spelling ... " prompt. The
share pathname and user information is surely correct. When I checked the
filesvr_computer's Event security log I get a event id 533, saying "User not
allowed to logon at this computer". Since the file server is also a Domain
controller we don't not want users to logon locally on the domain controller.
How can I get domain shares to be accessible on a non-domain computer using
valid domain authentication?

Thanks.

Joe
--------------

[Joe Thomas]

Hi Robert,

If I use the administrator domain account I can access the share without
problem, but I need the user domain account to be able to access the share
from the non domain computer.

Regards,

Joe
--------------------------

"Robert L [MS-MVP]" wrote:

> That should work. Try the administrator account. Can you access it?
>
> Bob Lin, MS-MVP, MCSE & CNE
> Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
> "Joe Thomas" <JoeThomas@discussions.microsoft.com> wrote in message news:94023592-B303-4C5F-B777-D6BBADA10230@microsoft.com...
> Hi,
>
> We have a domain controller that is also a file server running W2k3 SP1.
> There are shares defined on this machine. All machines that are connected to
> the domain can access the shares without problem. We have some machines that
> are not allowed to join the domain. However I need users who have domain
> accounts to be able access their shares from this non domain machine. Can I
> access the domain shares from a XP Pro SP2 machine that is not connected to
> the domain using valid domain accounts?
>
> When I key in \\filesvr_computer\share_folder as the address in Windows
> explorer on the non-domain computer I get a username and password prompt. I
> use a valid domain account username and password of the form
> "domainname\username" and the domain password, the prompt appears a second
> time. When I key in the same info again it comes out with a "Windows cannot
> find "\\filesvr_computer\share_folder". Check the spelling ... " prompt. The
> share pathname and user information is surely correct. When I checked the
> filesvr_computer's Event security log I get a event id 533, saying "User not
> allowed to logon at this computer". Since the file server is also a Domain
> controller we don't not want users to logon locally on the domain controller.
> How can I get domain shares to be accessible on a non-domain computer using
> valid domain authentication?
>
> Thanks.
>
> Joe
> --------------

[Robert L [MS-MVP]]

If administrator can access it but the user, I would check the permission. Also try this command: net view \\servername\sharedname /u:domanname\username. Do you receive system error 5?

Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
"Joe Thomas" <JoeThomas@discussions.microsoft.com> wrote in message news:EEE33547-4F4B-46F0-9323-923B16C71114@microsoft.com...
Hi Robert,

If I use the administrator domain account I can access the share without
problem, but I need the user domain account to be able to access the share
from the non domain computer.

Regards,

Joe
--------------------------

"Robert L [MS-MVP]" wrote:

> That should work. Try the administrator account. Can you access it?
>
> Bob Lin, MS-MVP, MCSE & CNE
> Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
> "Joe Thomas" <JoeThomas@discussions.microsoft.com> wrote in message news:94023592-B303-4C5F-B777-D6BBADA10230@microsoft.com...
> Hi,
>
> We have a domain controller that is also a file server running W2k3 SP1.
> There are shares defined on this machine. All machines that are connected to
> the domain can access the shares without problem. We have some machines that
> are not allowed to join the domain. However I need users who have domain
> accounts to be able access their shares from this non domain machine. Can I
> access the domain shares from a XP Pro SP2 machine that is not connected to
> the domain using valid domain accounts?
>
> When I key in \\filesvr_computer\share_folder as the address in Windows
> explorer on the non-domain computer I get a username and password prompt. I
> use a valid domain account username and password of the form
> "domainname\username" and the domain password, the prompt appears a second
> time. When I key in the same info again it comes out with a "Windows cannot
> find "\\filesvr_computer\share_folder". Check the spelling ... " prompt. The
> share pathname and user information is surely correct. When I checked the
> filesvr_computer's Event security log I get a event id 533, saying "User not
> allowed to logon at this computer". Since the file server is also a Domain
> controller we don't not want users to logon locally on the domain controller.
> How can I get domain shares to be accessible on a non-domain computer using
> valid domain authentication?
>
> Thanks.
>
> Joe
> --------------

[Joe Thomas]

Hi Robert,

I have already checked the permissions and they shouldn't be a problem
because the same share can be accessed by me when I login as a user on a
domain connected computer. The net view command doesn't take /u as an option,
it says "The option /u:mydomainname\myusername is unknown", any other syntax
you want me to try?

Regards,

Joe
--------------

"Robert L [MS-MVP]" wrote:

> If administrator can access it but the user, I would check the permission. Also try this command: net view \\servername\sharedname /u:domanname\username. Do you receive system error 5?
>
> Bob Lin, MS-MVP, MCSE & CNE
> Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
> "Joe Thomas" <JoeThomas@discussions.microsoft.com> wrote in message news:EEE33547-4F4B-46F0-9323-923B16C71114@microsoft.com...
> Hi Robert,
>
> If I use the administrator domain account I can access the share without
> problem, but I need the user domain account to be able to access the share
> from the non domain computer.
>
> Regards,
>
> Joe
> --------------------------
>
> "Robert L [MS-MVP]" wrote:
>
> > That should work. Try the administrator account. Can you access it?
> >
> > Bob Lin, MS-MVP, MCSE & CNE
> > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> > How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
> > "Joe Thomas" <JoeThomas@discussions.microsoft.com> wrote in message news:94023592-B303-4C5F-B777-D6BBADA10230@microsoft.com...
> > Hi,
> >
> > We have a domain controller that is also a file server running W2k3 SP1.
> > There are shares defined on this machine. All machines that are connected to
> > the domain can access the shares without problem. We have some machines that
> > are not allowed to join the domain. However I need users who have domain
> > accounts to be able access their shares from this non domain machine. Can I
> > access the domain shares from a XP Pro SP2 machine that is not connected to
> > the domain using valid domain accounts?
> >
> > When I key in \\filesvr_computer\share_folder as the address in Windows
> > explorer on the non-domain computer I get a username and password prompt. I
> > use a valid domain account username and password of the form
> > "domainname\username" and the domain password, the prompt appears a second
> > time. When I key in the same info again it comes out with a "Windows cannot
> > find "\\filesvr_computer\share_folder". Check the spelling ... " prompt. The
> > share pathname and user information is surely correct. When I checked the
> > filesvr_computer's Event security log I get a event id 533, saying "User not
> > allowed to logon at this computer". Since the file server is also a Domain
> > controller we don't not want users to logon locally on the domain controller.
> > How can I get domain shares to be accessible on a non-domain computer using
> > valid domain authentication?
> >
> > Thanks.
> >
> > Joe
> > --------------

[babak via WinServerKB.com]

hi joe ,
in a domain based environments , access to the objects can perform by a TOKEN
ACCESS LIST .
users obtain this token when they login to the Domain Controller , and that
shows a user can access to what of resources on the network. when a resource
is not i the domain , like your situation , the TOKEN ACCESS LIST can not
define that resource to the users , becouse that resource in not in the
directories of recourses of the DC.
i guess u , create LOCAL username and password on the computers of your
workgroup like the usernames and passwords of their Domain.
babak fruzanfar (mcp2k3)

--
Message posted via WinServerKB.com
http://www.winserverkb.com/Uwe/Forum...rking/200606/1

[Joe Thomas]

Hi Robert,

Instead of "net view" I tried "net use" and I got the following:-


System error 2240 has occurred.

The user is not allowed to log on from this workstation.


Any idea on what changes to make to allow share to be accessible from a non
domain computer?

Regards,

Joe
---------------------

"Robert L [MS-MVP]" wrote:

> If administrator can access it but the user, I would check the permission. Also try this command: net view \\servername\sharedname /u:domanname\username. Do you receive system error 5?
>
> Bob Lin, MS-MVP, MCSE & CNE
> Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
> "Joe Thomas" <JoeThomas@discussions.microsoft.com> wrote in message news:EEE33547-4F4B-46F0-9323-923B16C71114@microsoft.com...
> Hi Robert,
>
> If I use the administrator domain account I can access the share without
> problem, but I need the user domain account to be able to access the share
> from the non domain computer.
>
> Regards,
>
> Joe
> --------------------------
>
> "Robert L [MS-MVP]" wrote:
>
> > That should work. Try the administrator account. Can you access it?
> >
> > Bob Lin, MS-MVP, MCSE & CNE
> > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> > How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
> > "Joe Thomas" <JoeThomas@discussions.microsoft.com> wrote in message news:94023592-B303-4C5F-B777-D6BBADA10230@microsoft.com...
> > Hi,
> >
> > We have a domain controller that is also a file server running W2k3 SP1.
> > There are shares defined on this machine. All machines that are connected to
> > the domain can access the shares without problem. We have some machines that
> > are not allowed to join the domain. However I need users who have domain
> > accounts to be able access their shares from this non domain machine. Can I
> > access the domain shares from a XP Pro SP2 machine that is not connected to
> > the domain using valid domain accounts?
> >
> > When I key in \\filesvr_computer\share_folder as the address in Windows
> > explorer on the non-domain computer I get a username and password prompt. I
> > use a valid domain account username and password of the form
> > "domainname\username" and the domain password, the prompt appears a second
> > time. When I key in the same info again it comes out with a "Windows cannot
> > find "\\filesvr_computer\share_folder". Check the spelling ... " prompt. The
> > share pathname and user information is surely correct. When I checked the
> > filesvr_computer's Event security log I get a event id 533, saying "User not
> > allowed to logon at this computer". Since the file server is also a Domain
> > controller we don't not want users to logon locally on the domain controller.
> > How can I get domain shares to be accessible on a non-domain computer using
> > valid domain authentication?
> >
> > Thanks.
> >
> > Joe
> > --------------

[Joe Thomas]

Hi Babak,

Even with same local user name and password as the domain account I can't
access the share.

Regards,

Joe
-----------

"babak via WinServerKB.com" wrote:

> hi joe ,
> in a domain based environments , access to the objects can perform by a TOKEN
> ACCESS LIST .
> users obtain this token when they login to the Domain Controller , and that
> shows a user can access to what of resources on the network. when a resource
> is not i the domain , like your situation , the TOKEN ACCESS LIST can not
> define that resource to the users , becouse that resource in not in the
> directories of recourses of the DC.
> i guess u , create LOCAL username and password on the computers of your
> workgroup like the usernames and passwords of their Domain.
> babak fruzanfar (mcp2k3)
>
> --
> Message posted via WinServerKB.com
> http://www.winserverkb.com/Uwe/Forum...rking/200606/1
>
>