Permissions Troubles

[Devcon]

I have a few problems with permissions that I'd like to share.

I just bought an external 2.5 in hard drive to transfer files between computers. I initially branched the drive to my laptop, and all works well with my laptop. When trying to copy files on the disk to another computer, I have problems. I receive the message access denied with seemingly random files or folders. For example, I had a couple videos on my laptop that I wanted to share, but only a select few will copy over while the others state access denied. I don't know why the permissions would be different between these files.

Another problem lies with network permissions. I'm not sure how to effectively edit network permissions in regards to file sharing. Usually, simply enabling file sharing works well, but in this case it only works between certain computers. For example, I have my laptop on a wireless network with a host computer using internet connection sharing. The internet works great, but I cannot access shared folders on the laptop from the host computer. Also, I have the shared folders on the host computer setup with the settings that the laptop user can change and modify files, but currently, I cannot copy files from my computer to the host computer.

Another example. I installed cyber café software at a cyber café with just 4 computers. The host computer can communicate with the 3 client computers, but can only access shared folders on one of the clients. If I directly try to connect using the RUN command, ie. \\Client-3, I get a login popup with Invité (grayed over so it can't be changed). This, despite the fact that all client computers are using an administrative account.

Lastly, I have a problem in regards to the MMC (microsoft management console). So, I branched the client computers using the 'Allow only specified programs to run' option in group policy. However, I forgot to add MMC.exe to the list of allowed programs, so I cannot open group policy to install an additional program. I tried creating another administrative user to open mmc with no luck. Any ideas how to open MMC?

Thanks in advance for any insight...

 

[DelJo63]

on the MMC issue:
Boot into SAFE MODE, login is ADMIN, and then redo the GROUP policy.
It is FAR safer to EXCLUDE users and applications rather that ALLOW only specific -- now you know why

File permissions on drive:

I just bought an external 2.5 in hard drive to transfer files between computers. I initially branched the drive to my laptop, and all works well with my laptop. When trying to copy files on the disk to another computer, I have problems. I receive the message access denied with seemingly random files or folders. For example, I had a couple videos on my laptop that I wanted to share, but only a select few will copy over while the others state access denied. I don't know why the permissions would be different between these files.

Boot into Safe Mode with the device attached.
Right Click the device:\folder(s) and click properties.
On the Security Tab, allow Full Control for ALL USERS, for all sub folders.

 

[Devcon]

Ok, redoing mmc is possible in safe mode. I'll give it a go tomorrow. The reason I use allow only specific is simply because you never know what people will try to download and install. And using cybercafépro, you need to use an administrative account, and the security measures provided by the program are not sufficient. Listing allowed applications has helped tremendously with security as long as you remember to include mmc.exe. I believe I'm all set with the removable drive by doing the same thing without safe mode. I don't know why the permissions were not universal initially, but it was stupid of me not to check that.

I'm thinking that simply disabling simple file sharing opens a plethora of possible permissions issues. I've never had such network permissions issues, but I think it's just a matter of allowing everyone access on each shared folder.

Thanks for the info

 

[DelJo63]

you're welcome

fyi: you can still control Simple FS via passwords, but it's a setup per machine.

1) login via an Admin account & enable the Guest account
2) set a password you're willing to share with everyone to be authorized
(hint: don't give it to those not authorized and be prepared to change it as necessary)
3) disable the Guest account (which only stop keyboard logins).

anyone attempting access to \\FooMachine\FooSharedFolder will need
the Guest password on the FooMachine.

 

[Devcon]

on the MMC issue:
Boot into SAFE MODE, login is ADMIN, and then redo the GROUP policy.
It is FAR safer to EXCLUDE users and applications rather that ALLOW only specific -- now you know why

I still cannot seem to redo the group policy in safe mode. I still receive 'access denied'. Any ideas?

 

[DelJo63]

Can you DELETE the policy and recreate it?

 

[Devcon]

I believe the group policy is stored in a hidden group policy folder in C:\Windows\System32. I believe I tried to open the file, but I will attempt to delete it. Perhaps I'll just delete the entire folder and see what happens. I'll give it a go tomorrow or Monday.

Thanks buddy

 

[DelJo63]

Policies, that I know of, are located:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies​

ie: in the registry

 

[Devcon]

That could be a problem in that I cannot open regedit... Well, if i have time, I'll check tomorrow.

 

[Devcon]

For future reference in case someone else makes the same bonehead mistake... In safe mode, you can simply delete the hidden system folder in the System32 folder named 'grouppolicy'. After rebooting, you can just reinput the policy settings.

Thanks for the help

 

[Xeek]

cacls g:\* /t /c /g everyone:f
whatever drive letter
cacls /?
if you want

 

[DelJo63]

for the record and future reference:

CACLS syntax and usage