Re: Requiring User Name and Password for Connection to Network Res

On Fri, 2 Jun 2006 12:32:01 -0700, John Bigelow
<JohnBigelow@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

"Chuck" wrote:

On Fri, 2 Jun 2006 10:44:02 -0700, John Bigelow
<JohnBigelow@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

"Chuck" wrote:

<BIG SNIP>

1) If your server is using Advanced File Sharing, and you're logged in locally
with an account that is mirrored on the server, you'll get connected
automatically.

2) If you're logged in locally with an account that is NOT mirrored on the
server, and Guest is activated for network access, you'll authenticate with
Guest.

3) If you're logged in locally with an account that is NOT mirrored on the
server, and Guest is NOT activated for network access, it will ask you to
authenticate.

4) The Microsoft white paper is a good reference here. You need to:
# Enable Advanced File Sharing.
# Disable Guest for network access.
# Ensure that no non-Guest accounts are mirrored on any potential clients.
# Ensure that at least one non-Guest account is activated for network access.
<http://nitecruzr.blogspot.com/2005/06/file-sharing-under-windows-xp.html#Activate>
http://nitecruzr.blogspot.com/2005/06/file-sharing-under-windows-xp.html#Activate
# Access the server from your client. When it pops up with an authentication
demand, use the non-Guest account defined on the server.

Thank you very much for califying things. I will give it a try as you suggest.

Am I correct, by the way, in interpreting your answer to mean that there is
not a way of simply instructing the cliient computer to bypass all this
complex business about whether or not there's a mirrored account or a guest
account and simply ask the user to always supply a user name and password?

John,

There's not a SIMPLER way, as most folks don't care about manual authentication.
If your account (on your local computer) is mirrored on the server, why would
you want the server to ask you to authenticate again?

So by design, if your account is mirrored on the server, you aren't asked to
authenticate. The Guest account is used as a fallback; if it's active on the
server, you aren't asked to authenticate.

Windows 98 used password protected shares ("Share-Level Access"), or optionally,
user protected shares ("User-Level Access"). Folks preferred the latter. Most
folks use user level access, and love it.

Having written all of that, I'm curious now. Why do you WANT to authenticate
repeatedly?

Oh well. I must have seen something else and just misinterpreted it, so that
I thought it compelled what you call "manual authentication."

Thank you kindly for all the time you have evidently put into following this
thread with me. No matter what the outcome, I'm very grateful!

As for why, it's a fair question. We have this shared storage device in our
office that appears to be tempermental. There are people in my office who
tell me they can connect one one day, and then the next day they can't.
Typically the error message is someting along the lines of "You don't have
permission to access this resource. Check your user name and password blah
blah blah blah." Now in all these cases, the folks who are having trouble
haven't actually typed ANY username or password, so there's nothing for them
to check!

Hence my question. If we could arrange things so that the user actually had
control over the user name and password that is passed to the remote
resource, then (I think) we ought to have better and more predictable
success. Since I now have learned from you that the manual approach is not
possible, I will have to figure out another approach. Thanks to you, I
have a good starting point in the essay to which you directed my attention.
I'll be reading that rather carefully before tying to develop another
approach to our problem.

OK, John,

I think that you may have a rather common problem that's discussed here. The
generic message "You don't have permission to access this resource BLAH BLAH
BLAH" can have many reasons for coming up. Many of them typically will NOT be
solved by manual authentication.

If the problem is transient ("temperamental"), I'd bet you have a variant of a
master browser conflict. Let's do some diagnosis of the problem.

First, when you see the message, what is the complete and exact content? That
could be essential.
<http://nitecruzr.blogspot.com/2006/01/look-at-complete-detail-in-error.html>
http://nitecruzr.blogspot.com/2006/01/look-at-complete-detail-in-error.html

The next time that you see the message, provide "browstat status", "ipconfig
/all", "net config server", and "net config workstation", from the problem
computer at the time, and from one non problem computer, and diagnose the
problem. Read this article, and linked articles, and follow instructions
precisely (download browstat!):
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp>
http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp

You may also read about the browser in general:
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>
http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html

And about diagnosing the problem:
<http://nitecruzr.blogspot.com/2005/10/irregularities-in-workgroup-visibility.html>
http://nitecruzr.blogspot.com/2005/10/irregularities-in-workgroup-visibility.html

--
Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.
.

Relevant Pages

  • Re: Requiring User Name and Password for Connection to Network Res
    ... If you don't have a matching account on the server, and if the Guest account on ... then the server should request that you authenticate ...
    (microsoft.public.windowsxp.network_web)
  • Re: Massive queues
    ... could just as easily use the verified account. ... Exchange server, at the firewall usually takes care of any spamming ... in" and use your machine as a relay server. ... Allow all computers which successfully authenticate to relay, ...
    (microsoft.public.exchange.admin)
  • Re: Requiring User Name and Password for Connection to Network Res
    ... connected via a Peer to Peer LAN with one another and a shared network ... If you don't have a matching account on the server, and if the Guest account on ... then the server should request that you authenticate ...
    (microsoft.public.windowsxp.network_web)
  • Re: making a Web Request from my server
    ... I'm aware of the Double hop issue and thought I had it covered, we currently authenticate via the same server against remote databases as the impersonated user fine. ... As for this issue, since you mentioned that the webrequest call in VS Test Server works, but fails in deployment environment, I think it is likely caused by security account problem. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Re-Post - "the trust relationship between this workstation and the
    ... "the trust relationship between this workstation and the primary domain ... only problem is adding a new user account on the station. ... Client computer must use STRICTLY the INTERNAL DNS server which can ... Attr: subschemaSubentry ...
    (microsoft.public.windows.server.active_directory)
Quantcast