Permissions problem

[Olli1009]

Hi there,

We seem to have a weird problem with a certain user's permissions -

We have a file server which is Windows 2000 server and a user who uses Windows XP. There is a shared folder on the file server with many subfolders.

While the XP user logs in to his workstation and tries to save a file in one of the subfolders on the file server, he sees all of them as "read only" and of course cannot make changes. This is strange, because his permissions are "full control" (both share permissions and NTFS persmissions).

When the user logs in to a Win2k Professional workstation and tries to work with the folders on the file server, his permissions are indeed full control and there is no problem whatsoever.

So i suppose, the problem is the XP machine...does anyone have any ideas?

Thanks!

 

[bcastner]

http://support.microsoft.com/default.aspx?scid=kb;en-us;814112

SP4 on the Win2k server helps as well with this issue.

 

[Olli1009]

Thanks for the link, i tried all the hotfixes/solutions but still, the problem remains.

 

[bcastner]

1. Configure opportunistic locking on server and on workstation:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;296264

2. Make the SMB edits at the server:

To temporarily work around the problem, you can disable SMB signing on servers that host resources for XP SP1 clients. To do so, you need to modify the Default Domain Controllers policy, a built-in policy that applies to all DCs. Open the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in. Right-click the Domain Controllers organizational unit (OU), and click Properties. Click the Group Policies tab, select the Default Domain Controllers Policy, then click Edit. Expand the keys and navigate to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. Here, you will find four of Win2K’s SMB signing options, including

Digitally sign client communication (always)
Digitally sign client communication (when possible)
Digitally sign server communication (always)
Digitally sign server communication (when possible)

A default DC installation enables the last option, "Digitally sign server communication (when possible)." You turn off SMB signing on a DC by disabling this feature. If the last option isn't enabled, check the settings for the other three options and disable every enabled SMB option. At this point, you can wait 5 minutes for the automatic Group Policy refresh cycle, or you can manually refresh the policy on each DC with the command secedit/refreshpolicy machine_policy/enforce. The Microsoft article "Network File Errors Occur After You Install Windows XP SP1" at

http://support.microsoft.com/default.aspx?scid=kb;en-us;q331519

documents this workaround.