none
DFS root/link permission access problems

    Question

  • DFS root/link permission access problems

    I am setting up a DFS root server in order to replicate a network share folder structure on two networks. On the first network, all of the network shares are actually located on one system running Windows 7. On the second network, I need the shares to fit the same folder structure as the first network, but the subfolders are each located on a number of different systems on the network. I've never setup a DFS server before, but I'm currently trying to get it working on the first network. The server is a Windows 2008 R2 virtual machine on the Windows 7 system sharing the files. I've created the DFS root and a couple of links to the network shares.

    The problem I'm having is accessing the network share from the DFS server in a couple of cases. First, I need to be able to read the files from a standard user account that doesn't have a password. I added "Everyone" with read access to the DFS root permissions, but when I try to access the root from the Windows 7 system with the password-less account, it prompts for a username and password. I can access the files fine from the Windows Server 2008 R2 system with the standard password-less user though.

    Also, the administrator account that has a password on the Windows 7 system, which has been granted full control both on the NTFS permissions of the shared folders as well as the share itself, is unable to access the folders through the links from the DFS server. It gives the error:

    \\win2008server\dfs\share is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.
    
    Network access is denied.

    It can access the shares fine from its own network share (\\win7system\share), but not through the server share (\\win2008server\dfs\share). The same administrator account on other systems on the network can access the files fine though. I've tested it on the Windows 2008 Server R2 system as well as another laptop. So it's only a problem on the computer where the links point to.

    Any help you can give me getting this setup would be much appreciated. Thanks!
    Thursday, October 29, 2009 11:26 PM

Answers

  • The share permissions are setup correctly. I can access the share from other computers using the exact same account and password. I do not have anti-virus software installed on either system yet as I wanted to make sure the file services were working first. I have to have Windows 7 running on the system with the file share because I need Media Center on this computer. I am currently looking for a way to pass the volume the shares are located on to the Windows Server 2008 R2 virtual machine as this would solve the problem of not being able to access the shares from the Windows 7 system. But I'm still wondering should the namespace target system normally be able to access its own shares through the DFS server path?
    • Proposed as answer by GWhip Saturday, November 7, 2009 2:41 AM
    • Marked as answer by David Shen Monday, November 9, 2009 4:01 PM
    Wednesday, November 4, 2009 9:29 PM

All replies

  • Hi jeffdgr8,

    To access the target share
    \\win2008server\dfs\share successfully, please verify that the network connectivity between the source server and the target server is normal.

    Can you ping through the targer server Wind2008serve from the problematic client?

    Meanwhile, you will need to grant the user logon the client with Share and NTFS permission to access the file share.

    moreover, if the DFS share is domain-base, can you please check if the problematic client is domain member?

    thanks and regards,
    David Shen


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Friday, October 30, 2009 8:32 AM
  • My DFS share is standalone and not domain based. I have granted NTFS and share permissions to the linked targets to have full access to the administrator account and read access to Everyone.

    I can ping the DFS server just fine. In fact, I can browse to \\win2008server\dfs without any trouble too (under the administrator account). It's when I try to access the links that it gives me the error. And this is only on the system that the links target back to. Other systems with the same administrator account can access the links without trouble.

    With the standard user account without a password I can browse to \\win2008server, but I'm unable to access the DFS root. It prompts me for a password, even though the permissions are set on the DFS root to allow read access to Everyone.

    So I seem to be having two problems: first accessing the linked targets from the system that is hosting the shares being linked to and second accessing the DFS root from a standard password-less account (other than from the DFS server itself). I hope this makes sense. Let me know if I need to clarify anything further.
    Friday, October 30, 2009 7:21 PM
  • I solved one of the problems. In order to access the DFS root with an account without a password I had to add read access for "Everyone" to the NTFS permissions of the physical folder on the server under C:\DfsRoots besides the permissions in the DFS management.

    I am still unable to access the links from the namespace server itself. So on any account on win7system if you browse to \\win2008server\dfs\share which links to \\win7system\share it gives the error: "\\win2008server\dfs\share is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions. Network access is denied." Accessing the share works correctly on other computers on the network, including win2008server. Is there away around this?
    Sunday, November 1, 2009 6:59 PM
  • Hi Jeff,

     

    As the error message appears when you browse to \\win2008server\dfs\share which links to \\win7system\share, please check if the share permission and NTFS permission is set with Allow access for the user that you currently logon.

     

    Meanwhile, please also check if there is any third party anti-virus software running on the file server \\win7system. According to our experience, it is reported that some anti-virus applications, such as Symantec Endpoint Protection, may affect the file sharing and printing function.

     

    Moreover, generally we don't use Windows 7 client as the host of target folder. Please consider putting the replicated folder on server OS (ex. Windows Server 2003 or Windows Server 2008)

     

    Hope this can be helpful.

     

    Best Regards,

    David Shen


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Wednesday, November 4, 2009 11:44 AM
  • The share permissions are setup correctly. I can access the share from other computers using the exact same account and password. I do not have anti-virus software installed on either system yet as I wanted to make sure the file services were working first. I have to have Windows 7 running on the system with the file share because I need Media Center on this computer. I am currently looking for a way to pass the volume the shares are located on to the Windows Server 2008 R2 virtual machine as this would solve the problem of not being able to access the shares from the Windows 7 system. But I'm still wondering should the namespace target system normally be able to access its own shares through the DFS server path?
    • Proposed as answer by GWhip Saturday, November 7, 2009 2:41 AM
    • Marked as answer by David Shen Monday, November 9, 2009 4:01 PM
    Wednesday, November 4, 2009 9:29 PM
  • Are you running Windows 7 Ultimate?  We are not having an issue with Windows 7 Enterprise and DFS but we have had issues with Ultimate and DFS.  We don't have a solution yet either.
    Saturday, November 7, 2009 2:43 AM
  • Yes, I am running Windows 7 Ultimate and I still haven't found a solution for this problem.
    Friday, November 13, 2009 9:30 PM
  • Jeff,

    Did you figure this one out? I'm having a similar issue. 2008 R2 server with DFS. Set up shares and given read/write to my admin, everyone read, and get the same.."The network location cannot be reached" then a blurb about networking help. I'm just trying to access from windows explorer after setting up the shares. Tried accessing from a domain computer with admin account too. There has to be a permission setup I'm missing but I'm stumped at the moment.


    TPW
    Wednesday, December 2, 2009 4:09 PM
  • If anyone has a solution for this Please post it here.  I have the same problem resolving DFS links and would certainly appriciate a solution.
    Thursday, March 4, 2010 8:57 PM
  • I had this problem and found that I had to add domain users (full access) to the DFS Link share on the file system.  (c:\DFSroots\yourdfslink) For my server.

    Right click on the dfslink under DFSroots, and verify the share permissions.

    jgm

    Friday, April 9, 2010 1:16 AM