Permission Puzzle: Can't Exclude User but Allow Others to Access

[tobor8thman]

Hi All,

To follow up with #40 above, I checked to make sure that the user accounts and passwords were exactly the same on the remote PC (the Win 8 Pro PC acting as a "server") as they are on the PCs which are accessing the Win 8 Pro remote "server." Password protection for shares is off in the Win 8 Pro remote PC.

The only way that I am getting access to any of the files on the remote PC is by making sure that the "Everyone" group is in every folder. How can I NOT have the "Everyone" group in every folder? I just want to put the specific User Account with the specific permissions in every folder.

When I put "Everyone" in every folder, I can't exclude User Accounts I want to exclude, but when I remove "Everyone," NONE of the User Accounts have access even though I have the specific User Accounts with the correct permissions in every folder. This is also true with members of Homegroup--even Homegroup members are excluded when "Everyone" is removed from the NTFS permissions. Is this the way it is supposed to work? I thoroughly read the Sticky in Sevenforums about Permissions, and I see in the screen shots that "Everyone" is not among the groups listed in the permissions, so I am not understanding the logic of NTFS permissions.

 

[Kaktussoft]

Hi All,

To follow up with #40 above, I checked to make sure that the user accounts and passwords were exactly the same on the remote PC (the Win 8 Pro PC acting as a "server") as they are on the PCs which are accessing the Win 8 Pro remote "server." Password protection for shares is off in the Win 8 Pro remote PC.

The only way that I am getting access to any of the files on the remote PC is by making sure that the "Everyone" group is in every folder. How can I NOT have the "Everyone" group in every folder? I just want to put the specific User Account with the specific permissions in every folder.

When I put "Everyone" in every folder, I can't exclude User Accounts I want to exclude, but when I remove "Everyone," NONE of the User Accounts have access even though I have the specific User Accounts with the correct permissions in every folder. This is also true with members of Homegroup--even Homegroup members are excluded when "Everyone" is removed from the NTFS permissions. Is this the way it is supposed to work? I thoroughly read the Sticky in Sevenforums about Permissions, and I see in the screen shots that "Everyone" is not among the groups listed in the permissions, so I am not understanding the logic of NTFS permissions.

"Password protection for shares is off in the Win 8 Pro remote PC" . So any remote connection will be made as user GUEST (member of group EVERYONE).
If server and client are in same homegroup: user connects as HomeGroupUser$ (member of HomeGroup)

"Password protection for shares is off in the Win 8 Pro remote PC": put it on instead!

 

[tobor8thman]

Ah! didn't know that the guest log on came on that way, thanks I will try it and get back to you.

 

[tobor8thman]

Hi All,

I turned on Password Protected Sharing on the Win 8 Pro PC (acting as a server) and all the members of Homegroup had no problem accessing the files, but the two account members of the Workgroup PC could not access any files--permission was denied. I looked at the Sharing tab on the Win 8 PC and only Homegroup, User Account 5 (the User Account from the Workgroup PC I want to have access) Administrators and Administrator were members. I looked at the Security tab and the same members were listed there too (except for "Homegroup" there was "HomeUsers").

Maybe Homegroup and Workgroup cannot work side by side--is that possible, it has to be one or the other. Should I just put all the User Accounts in Homegroup and try to exclude from there?

 

[Kaktussoft]

User Account 5 can loggon locally on win8pro server and can access the files you want?

but the two account members of the Workgroup PC could not access any files--permission was denied

Only files ot folders as well?

 

[tobor8thman]

User Account 5 can log on locally on win8pro server and can access the files you want?

but the two account members of the Workgroup PC could not access any files--permission was denied

Only files ot folders as well?

Wow, I thought I solved this mess, but I didn't. I NOW made the network all Windows 7 (except for the Win 8 Pro PC which is acting as a server). We had a mixture of PC's before.

I then moved everyone to Homegroup. So far so good. I went on the Win 8 Pro PC (server) and checked each user account to determine if I could get access to the FILES and FOLDERS. (I had shared each of the five folders with Homegroup on the Win 8 Pro). I also made sure that the passwords to the user accounts on the Win 8 Pro would not expire. I have six User Accounts on the Win 8 Pro PC and those User Accounts match letter for letter the six User Account Name and Passwords on the three PC's and laptops connected to the network.

Not surprisingly, all three PC's (and all six User Accounts) could REMOTELY access the five folders on the Win 8 Pro PC with Homegroup listed under the Share Tab. Using the Share dialog on the Win 8 PC, I then REMOVED Homegroup Sharing from one of the folders (lets call it Folder 1) leaving Administrator and Administrators and adding User Accounts 1,2,3,4,and 6 under the Share tab (I wanted to exclude User Account 5). I then checked LOCALLY on the Win 8 Pro PC if User Accounts 1-4 and 6 could access Folder 1 and its files and they did so without difficulty.

When I looked in File Explorer under HomeGroup from each of the 3 remote PC's, Folder 1, as expected, did not appear (because I took HomeGroup out of Sharing). But when I looked under Workgroup in the 3 PC's. I saw Folder 1, but could not access it remotely, permission was denied.

I am not an IT professional, but I thought the logic of permissions was if you have the same User Accounts and Passwords on the server as you do on the remote PC's, you can control access by adding or omitting User Accounts under the Sharing Tab. This had not been working for me, even with Homegroup. It only works if I put "Everyone" in the Share, but then that defeats the point of excluding people from files. Please advise if you have any ideas.

 

[Kaktussoft]

When I looked in File Explorer under HomeGroup from each of the 3 remote PC's, Folder 1, as expected, did not appear (because I took HomeGroup out of Sharing). But when I looked under Workgroup in the 3 PC's. I saw Folder 1, but could not access it remotely, permission was denied.

They're not shared in HOMEGROUP so not listed. You see them under WORKGROUP so you can (try to) connect as another user.

 

[tobor8thman]

When I looked in File Explorer under HomeGroup from each of the 3 remote PC's, Folder 1, as expected, did not appear (because I took HomeGroup out of Sharing). But when I looked under Workgroup in the 3 PC's. I saw Folder 1, but could not access it remotely, permission was denied.

They're not shared in HOMEGROUP so not listed. You see them under WORKGROUP so you can (try to) connect as another user.

That's right, they are not seen in HOMEGROUP because I removed HOMEGROUP from under the sharing tab. I can't access the files over the network, however, under WORKGROUP for some unknown reason, even though I have specified the User Account under the Sharing tab, AND the same User Account and Password can access the file locally. [Scratching head].

 

[Kaktussoft]

"Password protection for shares is off in the Win 8 Pro remote PC": put it on instead!
Is it still on?

 

[Kaktussoft]

When I looked in File Explorer under HomeGroup from each of the 3 remote PC's, Folder 1, as expected, did not appear (because I took HomeGroup out of Sharing). But when I looked under Workgroup in the 3 PC's. I saw Folder 1, but could not access it remotely, permission was denied.

They're not shared in HOMEGROUP so not listed. You see them under WORKGROUP so you can (try to) connect as another user.

That's right, they are not seen in HOMEGROUP because I removed HOMEGROUP from under the sharing tab. I can't access the files over the network, however, under WORKGROUP for some unknown reason, even though I have specified the User Account under the Sharing tab, AND the same User Account and Password can access the file locally. [Scratching head].

Run on server: fsmgmt.msc
Click on tab "sessions" . Now you see who's connected and under what logon name. Check it please. Of course there must be a valid session to see it. So share it with "Everyone" first (NTFS security as well). Later remove "Everyone"

 

[Kaktussoft]

It's all described here Password Protected Sharing - Turn On or Off

 

[tobor8thman]

They're not shared in HOMEGROUP so not listed. You see them under WORKGROUP so you can (try to) connect as another user.

That's right, they are not seen in HOMEGROUP because I removed HOMEGROUP from under the sharing tab. I can't access the files over the network, however, under WORKGROUP for some unknown reason, even though I have specified the User Account under the Sharing tab, AND the same User Account and Password can access the file locally. [Scratching head].

Run on server: fsmgmt.msc
Click on tab "sessions" . Now you see who's connected and under what logon name. Check it please. Of course there must be a valid session to see it. So share it with "Everyone" first (NTFS security as well). Later remove "Everyone"

I ran fsmgmt.msc after I put "Everyone" in two of the files. I looked at Sessions and Open Files and saw all the remote PC's listed and the correct files opened. All of the PC's were in Homegroup at the time, so I saw the computer name and "HomeGroupUsers$ listed. I then took one of the PC's out of Homegroup--call it PC1 (its the PC that has the two User Accounts and the one I have been having the permission problem with). I put "Everyone" in the file shares and permissions. I then ran fsmgmt.msc again. All the PC names and User Accounts were listed again, some under HomegrupUsers$ and others not, and in the Open File tab, the file which PC1 opened was listed.

Finally, I removed "Everyone" from the share and permissions and just listed in the two files' share and permissions a specific User Account on PC1 to have full access. I ran fsmgmt.msc a third time and POOF! the computer name, the User Account and even the file name were gone and not listed under the Sessions and Open File tabs. No files were listed under the Shares tab. That shouldn't happen, right? I know by running fsmgmt.msc that the remote computer (PC1) is being recognized by the server and the User Account is logging in, but they are only doing so when I put "Everyone" in the shares and permissions. I should be able to have the same result with a specific permission designation and not placing "Everyone" in the shares or permissions, right?

 

[chev65]

The following procedure should work to allow access to one folder for one user which you then map as a network drive.
Transfer Files Between a Windows 8 PC and a Windows 7 PC

Not sure where you are with this but it shouldn't be taking this long.

 

[tobor8thman]

The following procedure should work to allow access to one folder for one user which you then map as a network drive.
Transfer Files Between a Windows 8 PC and a Windows 7 PC

Not sure where you are with this but it shouldn't be taking this long.

Like you say on your signature line "relentless patience."

Your approach may solve the problem, I didn't think of doing it that way--I will try it tonight. But even if the problem is solved, I would still like to know why I am having difficulties setting permissions to exclude one user account, especially when the user account log on disappears when I remove "Everyone" and just leave the specific user account designation in it. I even tried leaving "Everyone" in and narrowing down the specific user account designation to just "read" and that didn't have any effect either. The User Account still had full control.