Server Access Problem

rickjr13 · 07-24-2008, 10:49 AM

So I have two servers, a DC and an Exchange/Profile/Home directory server. Problem I am having is that my users can login to the domain, but can't access exchange/profiles/home folders. Seems that everything on the second server gives me a "i don't have permission to network resource" error. All these users are part of the domain users group, but the users who are domain admins have no problem accessing the second server and all of its resources. I have been trying to figure this out for the last couple of days with no luck, I've been looking into the NTFS permission for the second server and then added domain users group but still no luck. hopefully someone out there has experienced this and can give me a hand.

kinbard · 07-24-2008, 10:56 AM

Is terminal services configured on the exchange server?

djaburg · 07-24-2008, 11:01 AM

I'm sure you've thought of this, but I've seen it before, is the second server joined as a member server on the domain or are you using it stand-alone. And has this configuration worked before or is this something new?

rickjr13 · 07-24-2008, 11:15 AM

The server is configured for Terminal Services, I Remote Desktop to do some administration. As far as configuration, it is default, I have not changed anything.

The server is joined to the domain and the problem just seemed to spring up out of nowhere, it had been working fine before this. One thing that I did do that I didn't think would cause any problem was I moved to server from the "computers" container to another OU for all of my workstations and non-dc servers. Do you think this had any affect on what is causing my problem?

kinbard · 07-24-2008, 11:31 AM

Quote:

Originally Posted by rickjr13

One thing that I did do that I didn't think would cause any problem was I moved to server from the "computers" container to another OU for all of my workstations and non-dc servers. Do you think this had any affect on what is causing my problem?

It sounds like it to me. Check the permissions of that ou.

rickjr13 · 07-24-2008, 11:55 AM

Checked the permissions of that OU. Saw the Authenticated Users group has read, no group for Domain Users. I then added my test account and gave it full control to see if I would be able to access the server but still no luck. I have since removed the test account from the control list. I also checked the "Effective Permission" tab and see that my test account has the appropriate permission to be able to access the server.

kinbard · 07-24-2008, 11:57 AM

Check the domain policy.

rickjr13 · 07-24-2008, 12:04 PM

What exactly would I be checking the Domain Policy for?

kinbard · 07-24-2008, 12:06 PM

To see if there is anything in there that would be be over-riding the other permissions. You can lock things down pretty tight with a policy.

rickjr13 · 07-24-2008, 12:51 PM

I checked the Domain Policy, I don't have any but the password policy defined. This is a fairly new network and I haven't had to much time to set my policies yet. I did however enforce my default domain policy hoping this would take precedence over anything set either within another OU or on the local policy of server two. Still no luck.

kinbard · 07-24-2008, 12:53 PM

If you move it back to the original ou, does everything work again?

rickjr13 · 07-24-2008, 01:38 PM

Moved it back, rebooted servers, Domain Users still can't access server2. This is confusing the hell out of me.

kinbard · 07-24-2008, 01:47 PM

I did not see that happening. Admins can still access?

rickjr13 · 07-24-2008, 01:53 PM

Yeah, I added my test account to the Domain Admins group and I logged in just fine, found my profile, I could browse to the public share drive on server2. Seems like it has to be a permission setting somewhere not allowing the domain users but allowing the domain admins.

kinbard · 07-24-2008, 01:55 PM

It is a permissions issue, but it not working when back in the original ou says it is being overridden somewhere else. Unless I misunderstood. Were the users able to access it before you moved it from the original ou?

rickjr13 · 07-24-2008, 02:19 PM

Yeah, they were able to access it. I don't recall exactly when they started to notice that they could not access resources on server2, it may or may not be directly related to me moving the server to another OU. Moving it is the last thing I think I did to AD.

kinbard · 07-24-2008, 02:27 PM

Just to say we tried, make test a remote desktop user and see the account can access.

rickjr13 · 07-24-2008, 02:43 PM

I added the test account to the remote desktop users group, still nothing. When it tries to find my profile it gives me the error:

Logon failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced.

I don't have a blank password, I don't have logon hour restrictions, guess that leave GP restriction, but I already looked into that, might be to dig around there a little more. You ever had this error?

kinbard · 07-24-2008, 02:54 PM

Yes. Its a standard policy error message. Something way down in the policy is causing this.
Going through it is going to be a chore, but you might be able to export the policy from your other server. I have to go to a pc where I have ad and admin tools installed to check. I'm not sure I will be able to do that today, though.

07-24-2008, 10:49 AM	#1 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Server Access Problem So I have two servers, a DC and an Exchange/Profile/Home directory server. Problem I am having is that my users can login to the domain, but can't access exchange/profiles/home folders. Seems that everything on the second server gives me a "i don't have permission to network resource" error. All these users are part of the domain users group, but the users who are domain admins have no problem accessing the second server and all of its resources. I have been trying to figure this out for the last couple of days with no luck, I've been looking into the NTFS permission for the second server and then added domain users group but still no luck. hopefully someone out there has experienced this and can give me a hand.

07-24-2008, 10:56 AM	#2 (permalink)
kinbard Hardware Tech Team Join Date: Jun 2006 Location: Texas Posts: 2,365 OS: Solaris 10, XP,SuSE10, 10.3,11, Freespire,PCLinuxOS, Vista HP, and a partridge in a pear tree	Re: Server Access Problem Is terminal services configured on the exchange server? __________________ Half viking, half pirate, stronger than both 5 Steps XP Repair

07-24-2008, 11:01 AM	#3 (permalink)
djaburg Registered User Join Date: May 2008 Posts: 333 OS: XP SP2	Re: Server Access Problem I'm sure you've thought of this, but I've seen it before, is the second server joined as a member server on the domain or are you using it stand-alone. And has this configuration worked before or is this something new? __________________ Computers make it easier to do a lot of things, but most of the things they make it easier to do don't need to be done. Andy Rooney

07-24-2008, 11:15 AM	#4 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Re: Server Access Problem The server is configured for Terminal Services, I Remote Desktop to do some administration. As far as configuration, it is default, I have not changed anything. The server is joined to the domain and the problem just seemed to spring up out of nowhere, it had been working fine before this. One thing that I did do that I didn't think would cause any problem was I moved to server from the "computers" container to another OU for all of my workstations and non-dc servers. Do you think this had any affect on what is causing my problem?

07-24-2008, 11:55 AM	#6 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Re: Server Access Problem Checked the permissions of that OU. Saw the Authenticated Users group has read, no group for Domain Users. I then added my test account and gave it full control to see if I would be able to access the server but still no luck. I have since removed the test account from the control list. I also checked the "Effective Permission" tab and see that my test account has the appropriate permission to be able to access the server.

07-24-2008, 11:57 AM	#7 (permalink)
kinbard Hardware Tech Team Join Date: Jun 2006 Location: Texas Posts: 2,365 OS: Solaris 10, XP,SuSE10, 10.3,11, Freespire,PCLinuxOS, Vista HP, and a partridge in a pear tree	Re: Server Access Problem Check the domain policy. __________________ Half viking, half pirate, stronger than both 5 Steps XP Repair

07-24-2008, 12:04 PM	#8 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Re: Server Access Problem What exactly would I be checking the Domain Policy for?

07-24-2008, 12:06 PM	#9 (permalink)
kinbard Hardware Tech Team Join Date: Jun 2006 Location: Texas Posts: 2,365 OS: Solaris 10, XP,SuSE10, 10.3,11, Freespire,PCLinuxOS, Vista HP, and a partridge in a pear tree	Re: Server Access Problem To see if there is anything in there that would be be over-riding the other permissions. You can lock things down pretty tight with a policy. __________________ Half viking, half pirate, stronger than both 5 Steps XP Repair

07-24-2008, 12:51 PM	#10 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Re: Server Access Problem I checked the Domain Policy, I don't have any but the password policy defined. This is a fairly new network and I haven't had to much time to set my policies yet. I did however enforce my default domain policy hoping this would take precedence over anything set either within another OU or on the local policy of server two. Still no luck.

07-24-2008, 12:53 PM	#11 (permalink)
kinbard Hardware Tech Team Join Date: Jun 2006 Location: Texas Posts: 2,365 OS: Solaris 10, XP,SuSE10, 10.3,11, Freespire,PCLinuxOS, Vista HP, and a partridge in a pear tree	Re: Server Access Problem If you move it back to the original ou, does everything work again? __________________ Half viking, half pirate, stronger than both 5 Steps XP Repair

07-24-2008, 01:38 PM	#12 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Re: Server Access Problem Moved it back, rebooted servers, Domain Users still can't access server2. This is confusing the hell out of me.

07-24-2008, 01:47 PM	#13 (permalink)
kinbard Hardware Tech Team Join Date: Jun 2006 Location: Texas Posts: 2,365 OS: Solaris 10, XP,SuSE10, 10.3,11, Freespire,PCLinuxOS, Vista HP, and a partridge in a pear tree	Re: Server Access Problem I did not see that happening. Admins can still access? __________________ Half viking, half pirate, stronger than both 5 Steps XP Repair

07-24-2008, 01:53 PM	#14 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Re: Server Access Problem Yeah, I added my test account to the Domain Admins group and I logged in just fine, found my profile, I could browse to the public share drive on server2. Seems like it has to be a permission setting somewhere not allowing the domain users but allowing the domain admins.

07-24-2008, 01:55 PM	#15 (permalink)
kinbard Hardware Tech Team Join Date: Jun 2006 Location: Texas Posts: 2,365 OS: Solaris 10, XP,SuSE10, 10.3,11, Freespire,PCLinuxOS, Vista HP, and a partridge in a pear tree	Re: Server Access Problem It is a permissions issue, but it not working when back in the original ou says it is being overridden somewhere else. Unless I misunderstood. Were the users able to access it before you moved it from the original ou? __________________ Half viking, half pirate, stronger than both 5 Steps XP Repair

07-24-2008, 02:19 PM	#16 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Re: Server Access Problem Yeah, they were able to access it. I don't recall exactly when they started to notice that they could not access resources on server2, it may or may not be directly related to me moving the server to another OU. Moving it is the last thing I think I did to AD.

07-24-2008, 02:27 PM	#17 (permalink)
kinbard Hardware Tech Team Join Date: Jun 2006 Location: Texas Posts: 2,365 OS: Solaris 10, XP,SuSE10, 10.3,11, Freespire,PCLinuxOS, Vista HP, and a partridge in a pear tree	Re: Server Access Problem Just to say we tried, make test a remote desktop user and see the account can access. __________________ Half viking, half pirate, stronger than both 5 Steps XP Repair

07-24-2008, 02:43 PM	#18 (permalink)
rickjr13 Registered User Join Date: Jul 2008 Posts: 12 OS: Windows 2k	Re: Server Access Problem I added the test account to the remote desktop users group, still nothing. When it tries to find my profile it gives me the error: Logon failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced. I don't have a blank password, I don't have logon hour restrictions, guess that leave GP restriction, but I already looked into that, might be to dig around there a little more. You ever had this error?

07-24-2008, 02:54 PM	#19 (permalink)
kinbard Hardware Tech Team Join Date: Jun 2006 Location: Texas Posts: 2,365 OS: Solaris 10, XP,SuSE10, 10.3,11, Freespire,PCLinuxOS, Vista HP, and a partridge in a pear tree	Re: Server Access Problem Yes. Its a standard policy error message. Something way down in the policy is causing this. Going through it is going to be a chore, but you might be able to export the policy from your other server. I have to go to a pc where I have ad and admin tools installed to check. I'm not sure I will be able to do that today, though. __________________ Half viking, half pirate, stronger than both 5 Steps XP Repair