Server 2008 R2 Folder premission ?

[pollardhimself]

Here is the scenario

I am a admin
If I logon to the client computer I can access the server and list everything with \\per510\d$\

If I logon the client computer with a non-admin user I cannot list the contents via \\per510\d$\ it ask for username and pass even if I put my admin username and pass in it will not list the folder contents

I have give all users right to read and list contents of the folder but they are unable to unless I physically share the d drive.

What do I need todo to give non admins the ability to list the folder contents?

 

[rasczak]

there are two sets of permissions.

1.) share permissions.

to set share permissions, on the local machine where the share is stored, right click on the folder and select properties. click on the share tab. from there you can give permission to the group (i would advise against giving permissions to individual users) that needs access to the share. giving read and list folder contents will allow users the ability to see the share and what's inside it.

2.) ntfs permissions.

to set ntfs permissions (more granular control over what people can do to the files inside the share) right click on the folder/files you wish to set permissions on and click properties > click on the security tab > add the groups you wish to give access to.

here's a quick link from a google search

http://www.windowsecurity.com/articles/Share-Permissions.html

 

[pollardhimself]

I have set ntfs permissions for the non admin user however when there logged in the client computer the user cannot access the server drive \ folder in which I have gave them ntfs permissions. This is my problem

If I share the folder and then give them permissions it works. I dont want the folder listed under the sever \\PER510


Im having a issue deploying software via gpo because of this it wont install from a non admin user

 

[rasczak]

in order for you do what I think you are asking, then give share permissions (read or read write) to the group in question. I.e. finance group. remove all other groups and users from that share, thus the only people who will be able to SEE the share would be the users in that group.

 

[pollardhimself]

in order for you do what I think you are asking, then give share permissions (read or read write) to the group in question. I.e. finance group. remove all other groups and users from that share, thus the only people who will be able to SEE the share would be the users in that group.

Yeah it will work that way but before I formatted the server I swore I had it working just by giving correct ntfs permissions

 

[Genx87]

D$ is an admin share.You will need to add the users to the local admin group. Is there a reason why you want to share an entire drive to users?

 

[Nothinman]

If I share the folder and then give them permissions it works. I dont want the folder listed under the sever \\PER510

Adding a $ to the end of any share "hides" it from explorer. However, that's enforced locally so anyone with even the slightest bit of knowledge will be able to find the share without much effort.

 

[pollardhimself]

I think I got some other issue I cannot get that software to install from group policy using computer configuration from any non admin user. Any Ideas

 

[rasczak]

I think I got some other issue I cannot get that software to install from group policy using computer configuration from any non admin user. Any Ideas

what is it you are trying to install, and what type of file is it? if i recall, you can only push out *.msi files via group policy. (though this may have changed with server 2008)

rights do not matter when it comes to pushing software via GPO. Then only thing needed is the *.msi file is in a share.

 

[pollardhimself]

its a .msi file.. Im going to remove all polices and just add that one. gpresult is showing its being applied but its not installing. Something is causing a issue

 

[rasczak]

have you rebooted the workstation?

Are you doing setting the policy up from the domain controller or local workstation?

and could you give a step by step on how you are adding the software package in the GPO?

 

[snikt]

Keep in mind, since you are trying to deploy the .msi file via GPO until the GPO is changed or removed, the .msi file will continue to install every time the users log in. Also, if users are out for a few days the program will not be installed on that particular box unless another user logs into it.

We tried this but it did not go as well as we would've liked because of the reason I mentioned earlier so we decided not to deploy installations this way.

 

[stlcardinals]

I would seriously recommend finding a community college or something of the like around you that offers Windows Server administration courses. I believe it could do wonders for you.

 

[pollardhimself]

Keep in mind, since you are trying to deploy the .msi file via GPO until the GPO is changed or removed, the .msi file will continue to install every time the users log in. Also, if users are out for a few days the program will not be installed on that particular box unless another user logs into it.

We tried this but it did not go as well as we would've liked because of the reason I mentioned earlier so we decided not to deploy installations this way.

It only reinstalls if its removed or not installed dont know why it did that to you

 

[pollardhimself]

I cant get any computer gpo objects to deploy

Not even showing up

 

[RebateMonger]

Your GPResults says you are "connected over a slow link".

MS: Group Policy and Slow Links:

http://technet.microsoft.com/en-us/library/cc728359(WS.10).aspx

"Some Group Policy is not applied when the connection speed fall below specified thresholds. Therefore, when your Group Policy solution calls for applying policy over slow links or by using remote access, you need to consider policy settings for slow link detection."

 

[pollardhimself]

Your GPResults says you are "connected over a slow link".

MS: Group Policy and Slow Links:

http://technet.microsoft.com/en-us/library/cc728359(WS.10).aspx

"Some Group Policy is not applied when the connection speed fall below specified thresholds. Therefore, when your Group Policy solution calls for applying policy over slow links or by using remote access, you need to consider policy settings for slow link detection."

the pings less than 1ms, one test client finally started reconizing the group policy and says its applied but it actually didnt install anything. Any ideas

 

[rasczak]

Keep in mind, since you are trying to deploy the .msi file via GPO until the GPO is changed or removed, the .msi file will continue to install every time the users log in. Also, if users are out for a few days the program will not be installed on that particular box unless another user logs into it.

We tried this but it did not go as well as we would've liked because of the reason I mentioned earlier so we decided not to deploy installations this way.

eh? you must be mistaking user configuration with computer configuration. if you push the software out via GPO using computer configuration, the software is installed once on the workstation. You can remove the GPO and the software will stay there until either you remove via GPO (right click on the package and select remove or you manually uninstall it. unless a user needs a specific piece of software, and they move from workstation to workstation constantly, then there should be no reason to setup software installation by user. Just set the software install by computer via computer configuration > software settings > software installation then let it run.

 

[rasczak]

I would seriously recommend finding a community college or something of the like around you that offers Windows Server administration courses. I believe it could do wonders for you.

unfortunately he probably doesn't have that luxury as he is time limited. we've all been in this situation before at least once. and we've all needed some assistance in one way or another with configuring a system or network or anything for that matter.

during my first six months at my current job, i was tasked with building out a network for a project i just got into, my only experience with building a network from scratch was a 2k server disk i had and two old computers i turned into a DC and member server. for the project, not only was i supposed to build out the domain, i needed to have a test domain running along side it, completely separate except for an ftp link between the two sites for file transfers. i had to configure a firewall which i had never done before as well as setup a wan link to an outside contractor. and I had to do this under DSS guidelines. so needless to say the security on that system was so tight that you could barely do anything with it.

i say let him tread this path gain valuable experience from it, and ask questions as needed. not too many people at his work are going to be able to say they built that network by themselves.

 

[pollardhimself]

I would seriously recommend finding a community college or something of the like around you that offers Windows Server administration courses. I believe it could do wonders for you.

Already took configuring windows server 2008 network infrastructure

Ill figure it out its just frustrating when I pull in a group policy I had saved before I started over and apply it the same way and it doesn't work. I know for a fact it worked im not sure what the issue is but if I tell it to re-deploy from group policy that app it show up in currently installed programs but it didnt actually install anything. Somethings screwy any msi file I apply with GP to the computer says the gpo applied but it really didnt

Ive just keep running into compatibility issues

for example uninstalling symantec protection manager completely ruins exchange 2010 management console. and you cant uninstall and reinstall exchange because you cant delete the mailboxes without the console

 

[snikt]

eh? you must be mistaking user configuration with computer configuration. if you push the software out via GPO using computer configuration, the software is installed once on the workstation. You can remove the GPO and the software will stay there until either you remove via GPO (right click on the package and select remove or you manually uninstall it. unless a user needs a specific piece of software, and they move from workstation to workstation constantly, then there should be no reason to setup software installation by user. Just set the software install by computer via computer configuration > software settings > software installation then let it run.

That's possible. I was not the lead on this particular deployment so I never followed up on it. At any rate, this deployment using GPO was an experiment of sorts to see if we should use GPO to push out installs. Prior to this we had started using Patchlink for installs, upgrades, patch roll out, etc. and decided to stick with Patchlink. Patchlink has worked out better for us for various reasons. Two in particular, it doesn't require users to be logged in and doesn't require admin privileges.

 

[RebateMonger]

Your GPResults says you are "connected over a slow link".

Is the client PC you are using connected to your server via wireless or an Internet VPN connection? I doubt it if you are getting 1 ms ping times. But you might want to know why Windows thinks you have a "slow link". By default, that means that Windows thinks your link to your server is slower than 500 kbps. Without changing policies on the server, lots of stuff won't be deployed via GPO.

 

[pollardhimself]

Is the client PC you are using connected to your server via wireless or an Internet VPN connection? I doubt it if you are getting 1 ms ping times. But you might want to know why Windows thinks you have a "slow link". By default, that means that Windows thinks your link to your server is slower than 500 kbps. Without changing policies on the server, lots of stuff won't be deployed via GPO.

I dont know why it showed that earlier, I think my clients are all screwy its not saying connected over slow link now.

Im going to connect my windows 7 machine and see what happens

Some of my issue was one of my clients not wanting to register itself with DNS. I still cant deploy any software under computer settings

 

[Nothinman]

If your PC thinks you're connected over a "slow link" and you're on a local LAN to the DC from which the GPO came, you've got bigger issues to worry about than GPOs.

 

[rasczak]

I dont know why it showed that earlier, I think my clients are all screwy its not saying connected over slow link now.

Im going to connect my windows 7 machine and see what happens

Some of my issue was one of my clients not wanting to register itself with DNS. I still cant deploy any software under computer settings

are you deploying the software to windows 7 boxes? I was under the impression these were xp workstations.

double check your dns settings on the nic in the problem box just to make sure your don't have a typo. if those are fine, use nslookup to determine if your workstation is able to find the dns server. if you cant find it, troubleshoot that before going any further into the GPO issues. chances are that if you get the dns issue fixed, you'll find the gpo issues work themselves out if you have configured the gpo correctly.

think you can take a snapshot of the policy expanded and post it for us?