User Permission Issues

[cybergenius]

I am having an issue with local users on a Windows 2003 server. The server sits on its own workgroup and has a few local users each belonging to the Administrator group. One Administrator account is different from the rest in that it was added before Terminal Server was installed on the box.

The permission problem occurs when trying to run an executable from a mapped drive. The mapped drive is on a separate domain which I login each time to when mapping. The user that was created before Terminal Server was installed is able to execute applications from this drive, but all new users are unable and receive a permission error "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access them.".

Anybody know how I can get my new Administrator users to have permission? I think its pretty funny that a Windows Administrator gets permission errors.

[cluberti]

The permission problem occurs when trying to run an executable from a mapped drive. The mapped drive is on a separate domain which I login each time to when mapping. The user that was created before Terminal Server was installed is able to execute applications from this drive, but all new users are unable and receive a permission error "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access them.".

A few things spring to mind - one, add the server and domain to the "Local Intranet" zone in IE (yes, this actually usually fixes it). If that doesn't work, get a process monitor log of the issue occurring, perhaps along with a network trace as a last resort.

[cybergenius]

The permission problem occurs when trying to run an executable from a mapped drive. The mapped drive is on a separate domain which I login each time to when mapping. The user that was created before Terminal Server was installed is able to execute applications from this drive, but all new users are unable and receive a permission error "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access them.".

A few things spring to mind - one, add the server and domain to the "Local Intranet" zone in IE (yes, this actually usually fixes it). If that doesn't work, get a process monitor log of the issue occurring, perhaps along with a network trace as a last resort.

The Local Intranet zones are already configured properly and it still has this problem. I tried running Process Explorer with my new administrator account and it also has the permission error. I am going to go ahead an uninstall terminal server and work backwards to try to fix this issue. Thanks for the advice.

[cybergenius]

I went ahead and uninstalled Terminal Server. After doing so I mapped to the network drive which has the application I am trying to execute (VC6). Again with no luck, I still receive the permission error. I went ahead and logged out of the account with permission issues and logged on with the account that works to delete the non-working account and re-add it again. This also did not work.

Here is some more info on my network setup.

Name - Server Type - Domain/Workgroup

------------------------------------------------

1) BuildMachine - Windows 2003 server - workgroup

2) DevMachine - Windows 2003 server - workgroup

3) AdminMachine - Windows 2003 SBS - Domain

Machine 1, BuildMachine, is the one which has the issues after installing Terminal Server. Machine 2, DevMachine, is almost exactly the same but has never had Terminal Server installed. All users on DevMachine are able to map to AdminMachine and execute applications without a problem. Only 2 users on BuildMachine (Default Administrator, and locally created Admin account before TS install) are able to connect.

Since I uninstalled Terminal Server and still see the issue I am thinking that its a possibility some restricted policy had been enabled and was never disabled after uninstall. Uninstalling and installing of Terminal Server requires a reboot so everything should have been reset afterwards. However I have looked at all the policies in Local Computer Policy editor and nothing jumps out at me restricting this type of access. I also checked out the Group Policy Object editor as well.

I will keep posting as I make progress. I am half tempted to reinstall the OS. We have a backup of the system, but I am not sure if it is a backup after installing TS or not.

(if anyone reads devshed forums I have posted this there too)

[cybergenius]

Actually I forgot to add that Machine 1 has routing and remote access enabled and Machine 2 does not.

[cybergenius]

The permission problem occurs when trying to run an executable from a mapped drive. The mapped drive is on a separate domain which I login each time to when mapping. The user that was created before Terminal Server was installed is able to execute applications from this drive, but all new users are unable and receive a permission error "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access them.".

A few things spring to mind - one, add the server and domain to the "Local Intranet" zone in IE (yes, this actually usually fixes it). If that doesn't work, get a process monitor log of the issue occurring, perhaps along with a network trace as a last resort.

Ok I went ahead and tried this out again with the zones. This time I added the box name of Machine 1 in the zone, and whala it worked!!! Thanks a million cluberti for your advice. Do you know why this is? Why would an internet zone affect this? Is this something new with IE 7?

[cluberti]

Remember that IE and the shell are inextricably linked, and the IE attachment engine is used when the shell accesses files (regardless of whether or not you're using IE or Windows Explorer).