network share does not prompt for alternate credentials

[pencil151]

I have XP pro desktops that are joined to a domain. Most users do not have access to the "\\server1\apps\" folder. There are not explicitly denied, just not on the ACL list. For the most part our helpdesk techs remote into the clients PC and need access to the apps folder. When they type in the UNC path into the run command they automatically get an "Access Denied" prompt. This is because regular users do not have access.

How do I get the network share to prompt for alternate credentials so when our techs need access to that share they do not have to log off the user and re-log in?

 

[Davetoo]

Do the users have anything already mapped, other than apps, so \\server1? If so, you can only access any server with one set of credentials.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[chipk]

If what Davetoo says is not the case (i.e. there are no other connections to this server), you can use net use to the admin share to create a temporarily privileged connection to that server. When the tech is done working, issue the same command with the /delete switch, so to make the connection:

net use \\server1\admin$

You'll be prompted for credentials. After you're finished, type:

net use \\server1\admin$ /delete

 

[Davetoo]

My post wasn't very clear...

You can only access a server using one set of credentials at a time, i.e. you can't have one connection to \\server1 using USERA and another connection to \\server1 using USERB. It won't allow it.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[pencil151]

Thanks for the quick response. No none of the users are mapped to \\Server1. That's strange I thought there would be a setting on the server side to turn this option of alternate credentials. Like an XP that's not joined to the domain, one XP machine to another will ask for credentials. I'm sure that's because it's not joined to the domain but I thought there would be a registry key or an option that I overlooked for domain file sharing. I could have sworn I've seen this behavior where it will prompt for credentials in other companies.

 

[chipk]

The "net use" thing should work. It only takes a few seconds to do this.

 

[lhuegele]

Try using the fully qualified server domain name instead of the netbios name.

\\Server1 (netbios)
\\Server1.mydomain.com (FQDN)

Good luck,

 

[pencil151]

I tried the "net use \\server1\apps$" and it performs the action, and at the end of the cmd prompt it says "the command completed successfully," but it did not prompt for user/pw. I had to create another share on the folder called "apps$" still does not prompt. However if I use "Net use \\server1\admin$" (which is a default admin share) it does prompt me. But the new hidden share I created does not.

I did try the FQDN and that doesn't resolve correctly. When I use the netbios name I can see the network share it's just access denied. I just want to be able to have the option of entering user/pw.

 

[chipk]

There's a reason I said to use the admin$ share. This will prompt you for administrative credentials, and basically open up the server to you using whatever credentials you supply. So, if you create the connection to \\server1\admin$ and then UNC to \\server1\apps, this should work for you and you should connect to that share as admin automatically.

 

[pencil151]

Oh I see. I understand how that works now. I thought I could create my own hidden share and do the same. Yes this does work but I was thinking there was another way by typing in just the UNC path.

 

[imbigdave]

In the same fashion, is there a way you can make it prompt for passwords by user accounts on a domain.

The reason I ask is that we have a conference room that is locked down to network drives, but I want our employees to be able to login and access these drives if they need.

Thanks

 

[linney]

There is a "Manage Passwords" section obtained via typing Control Userpasswords2 in the Start Run box. In the resulting window you will get to it via the Advanced tab.

See if there is anything mentioned in "Manage Passwords"?

Another thing you can look at is this -

306992 - HOW TO: Manage Stored User Names and Passwords on a Computer in a Domain in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;306992&FR=1&PA=1&SD=HSCH

306541 - HOW TO: Manage Stored User Names and Passwords on a Computer That Is Not in a Domain in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;306541&FR=1&PA=1&SD=HSCH

Behavior of stored user names and passwords

http://support.microsoft.com/kb/281660/?FR=1

 

[imbigdave]

Thanks for your quick response.

I see what you are suggesting but what I am trying to avoid is having to put every single user (about 50) into the computer. Instead I want to just have them prompted when they try to access network drives. Any ideas?

 

[linney]

Can you do something along the lines of creating a new Group and having all the users a member of the new group?

 

[cdogg]

imbigdave,
So are they using a "generic" login account on the computer in the conference room, or are they signing into the domain with their individual usernames?

Also, when a user is at their desk using their main PC, do you want the network drives to appear at logon?

~cdogg
"Insanity: doing the same thing over and over again and expecting different results." - Einstein
[tab][navy]For posting policies, click [/navy]here.

 

[imbigdave]

Thanks for the responses. I actually figured it out just before i read your responses. I forgot that I could give permissions to a group on a computer so that everyone could just login with their network accounts.

Thanks for you help!

 

[imbigdave]

I have another problem. I was able to add all users to the local computer, but the domain GPO settings have each users computers going to screen saver at 10 minutes and password protecting.

Well, in the conference rooms, if someone forgets to sign out, then the next person to use the computer is locked out. How can I disable the screensaver feature for just this conference room computer?

Thanks in advance

 

[twigusa]

You've answered your own question there. You probably need to disable the GPO from applying to that specific computer.