Windows 2003 file shares

[leighturner]

Hi all!

I am trying to gain access to our Windows 2003 file shares via an Apple Mac, I am going to: Go / Connect to Server / Browse / Network / domain / server / Connect...

SMB/CIFS File System Authentication

[Entered domain]
[Entered administrator in username field]
[Entered administrator password in password field]

The alias "server name" could not be opened, because the original item cannot be found.

I cannot understand this as I am logging in with administrator creds.

I have tried a share on a Windows XP machine and I can gain access to the share via the Apple Mac no problem!

Please advise,

Thanks in advance

Leigh



Leigh D Turner (BSc)

 

[brontosaurus]

Make sure you are allowing non-Kerberos connections to the 2003 server. I have seen many instances where macs can't connect because the windows server won't "dummy down" and allow NTLM v2 connections.

 

[leighturner]

Are you able to tell me where to allow non-kerberos connections on the server??

Leigh D Turner (BSc)

 

[leighturner]

I can gain access to all the other Windows 2003 servers apart from the two DNS servers?

Leigh D Turner (BSc)

 

[brontosaurus]

Allowing those connections is part of Group Policy. I think it's something like "Require Strong Session Key". Anyway, are you saying you can connect to file shares on all your 2003 servers, but not on your DNS servers? Are those DNS servers also Domain Controllers?

 

[leighturner]

Yes that is correct.

Leigh D Turner (BSc)

 

[brontosaurus]

Are any of the other servers you're able to connect to Domain Controllers? If not, it may be a policy, not necessarily the Kerberos one, that exerts higher security for Domain Controller connections?

 

[leighturner]

None of the others are Domain Controllers.

Any idea where to look for the new policy?

Leigh D Turner (BSc)

 

[brontosaurus]

I think it's under the Computer Configuration section, in the Windows Settings, Security Settings, Local Policies, Security Options.
In the meantime, try this: Create a new domain user (doesn't have to be admin) and assign modify permissions for this new account to the share and directory that you're trying to connect. Then try connecting with the new user credentials.

 

[leighturner]

Any idea what policy I would be looking for within Security Options?

Leigh D Turner (BSc)

 

[brontosaurus]

Domain Member: Require Strong Session Key

and maybe

Microsoft Network Client: Digitally Sign Communications (Always).

 

[leighturner]

Domain Member: Require Strong Session key is: Disabled.

Network Client: Digitally Sign Communication (Always)is: Disabled.

I persume both of these should be disabled anyway??

Leigh D Turner (BSc)

 

[brontosaurus]

Yes, that's fine. Try the alternative user account, make sure you set permissions on both the share level and directory levels.

 

[brontosaurus]

Also, make sure the policy for Microsoft Network Client: Digitally Sign Communication (If client agrees)is: Disabled