locked
net use access warning by MATA RRS feed

  • Question

  • Hi. When i execute below command from one machine to access C$ folder in "remote-machine" it returned access denied error, because the user is not domain admin.

    net use Q: \\remote-machine\c$  /u:"domain\username" "password"

    As i know when a user does not in "Domain Admins" group can not access C$ folder in remote machine, Is it true?

    although this command execution is failed and returned access denied but still MATA has below warning:



    what is this warning reason?

    Best regard

    Tuesday, June 26, 2018 2:20 PM

All replies

  • Hello,

    >>> As i know when a user does not in "Domain Admins" group can not access C$ folder in remote machine, Is it true?

    It depends on the NTFS permissions granted to the users for the C drive. You can check out the permissions by right clicking the C drive, and choose Properties -> Security.

    >>> what is this warning reason? 

    ATA entity profile provides you with a dashboard designed for full deep-dive investigation of users, computers, devices and the resources they have access to and their history.

    You can learn more by clicking the following link.

    https://docs.microsoft.com/en-us/advanced-threat-analytics/entity-profiles

    Best regards,
    Andy Liu


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, June 27, 2018 7:44 AM
  • >> It depends on the NTFS permissions granted to the users for the C drive. You can check out the permissions by right clicking the C drive, and choose Properties -> Security.

    I add permission to specific user, But still it can not have net use access to remote machine. I think your answer is not related and my question is about active directory groups and permissions. I think only "domain admin users" can do net use to remote machine and other users have not this allow.

    >>You can learn more by clicking the following link.

    Thank You Sir, it is useful and i learn good things.

    Wednesday, June 27, 2018 1:11 PM
  • any update?
    Saturday, June 30, 2018 1:59 PM
  • Hi Apristina,

    The request for accessing that resource was successfully made using Kerberos. We can’t really tell if the actual access was made or the what is the action result (failed due to permission/network or whatever).

    Therefore you see this access as logical activity.

    Thanks,

    Tali

    Sunday, July 1, 2018 3:59 PM