Need help with permissions on Win2k Server

[Hatemachine]

Ok, i have a small app server setup on our domain. There is a limited number of people that I am giving access to this server. When a tech is logged as an unauthorized user, i want them to be prompted with the "connect as" box. Currently it just gives the access denied.

 

[Rogue]

I'm not so sure that's a permission setting. I think that Win2k functions on the basis of, "If it's not explicityly granted, it's explicitly denied" with little or no in between settings. I'm by no means an expert on this topic, but I'm sure that's the way it works with NTFS.

 

[Hatemachine]

bump

 

[bignick]

The reason you are getting the access denied is the permissions are set to allow a specific group in, and the techs don't belong to the group. Therefore they aren't going to be given the opportunity to connect to the resource. The dialog box you are speaking of where it asks for username and password occurs most commonly when you try to connect to a resource that is on a server/workstation that isn't a member of your domain (i.e. a stand alone server). The box appears because NT/Win2k is unable to find a user account matching the one you are logged in as, therefore is doesn't "know" you, and will then prompt you for id. The access denied occurs because NT/Win2k finds your username, and then can find out which groups you belong to, then it compares your group membership to the permissions on the shared resource.

I know this sounds rather confusing, but trust me I know what I'm talking about. Where I work all 14k users belong in one domain, and each of the 100 departments has it's own resource domain. If I don't add the correct group to a resource domain, then the dialog box appears asking for username and password, and my users don't know what to do.