Denied by my own! Help!
September 1, 2011 7:03 PM Subscribe
I "don't have permission" to go into the desktop XP folders on my network from my Windows 7 laptop, but the reverse is fine. Help me?
On the occasion of getting a spiffy new wireless printer, I went through the hoopdedoodle of setting up a network on my new Windows 7 Home Premium SP1 laptop with my old Windows XP Pro SP3 desktop. They both link up fine with the printer, so that's good.
However, when I go into the network from the desktop (XP), I can get into the laptop (Win 7) fine. When I try to go into the desktop through the laptop via the network, I'm denied because I don't have permission. Password is off, file discovery on. Network stuff on. I can see the folders but can't get in them.
I've gone through what feels like every geek-aid how-to website out there for the last three days and none of their suggestions are working.
I just want to be able to access my documents folder for a little while longer until I can replace the desktop with one that also runs Win 7. What will actually work?
On the occasion of getting a spiffy new wireless printer, I went through the hoopdedoodle of setting up a network on my new Windows 7 Home Premium SP1 laptop with my old Windows XP Pro SP3 desktop. They both link up fine with the printer, so that's good.
However, when I go into the network from the desktop (XP), I can get into the laptop (Win 7) fine. When I try to go into the desktop through the laptop via the network, I'm denied because I don't have permission. Password is off, file discovery on. Network stuff on. I can see the folders but can't get in them.
I've gone through what feels like every geek-aid how-to website out there for the last three days and none of their suggestions are working.
I just want to be able to access my documents folder for a little while longer until I can replace the desktop with one that also runs Win 7. What will actually work?
Is it Win7 that's denying you, or XP saying you don't have the credentials? If the former, try opening the network folders as administrator. Either right click and look for "run as administrator", or win+R for the run command, type the IP address and folder locations that you want to go to (e.g. "\\192.168.0.1\sharedFolders\Media\Songs\Whatever") , and then push SHIFT-CTRL-ENTER instead of just ENTER on the run dialog.
If the latter, then I have no clue :(
posted by RobotNinja at 7:31 PM on September 1, 2011
If the latter, then I have no clue :(
posted by RobotNinja at 7:31 PM on September 1, 2011
Response by poster: If I'm on the XP machine, I can see and go into folders and open files from the Win 7 machine.
If I'm on the Win 7 machine, I can see the folders in the XP machine, but when I click to open them, that's when I get the "Windows cannot access/You don't have permission" message.
posted by droplet at 7:47 PM on September 1, 2011
If I'm on the Win 7 machine, I can see the folders in the XP machine, but when I click to open them, that's when I get the "Windows cannot access/You don't have permission" message.
posted by droplet at 7:47 PM on September 1, 2011
XP Home or Pro? They have different authentication schemes for network shares.
Also, how did you go about turning on networking on the XP box? If you did anything other than work through the Network Setup Wizard, various dark magics will stop XP sharing stuff.
Also also, are you running any version of Norton Antivirus on the XP box? It completely screws up network sharing. Give it the arse and install Panda Cloud Antivirus instead.
posted by flabdablet at 10:08 PM on September 1, 2011 [1 favorite]
Also, how did you go about turning on networking on the XP box? If you did anything other than work through the Network Setup Wizard, various dark magics will stop XP sharing stuff.
Also also, are you running any version of Norton Antivirus on the XP box? It completely screws up network sharing. Give it the arse and install Panda Cloud Antivirus instead.
posted by flabdablet at 10:08 PM on September 1, 2011 [1 favorite]
There are lots and lots of ways for Windows networking to fail. If you could post a screenshot of your 7 box failing to connect to your XP box, there would probably be clues there for experienced eyeballs.
posted by flabdablet at 10:09 PM on September 1, 2011
posted by flabdablet at 10:09 PM on September 1, 2011
I've said this before, but my XP-fu isn't what it was in '05.
Can you map the drive to be shared? Shit, does XP even use the old net use * \\MachineName\D$ stuff anymore?
Also flabdablet nails it above. I can tell you first hand of the hundreds of ways I've witnessed Windows based home-style networking to fail.
posted by Sphinx at 10:28 PM on September 1, 2011
Can you map the drive to be shared? Shit, does XP even use the old net use * \\MachineName\D$ stuff anymore?
Also flabdablet nails it above. I can tell you first hand of the hundreds of ways I've witnessed Windows based home-style networking to fail.
posted by Sphinx at 10:28 PM on September 1, 2011
does XP even use the old net use * \\MachineName\D$ stuff anymore?
XP Pro has hidden administrative shares set up on the root folders of all drives by default (can't remember if this goes away with Simple File Sharing or not); XP Home doesn't.
Turning on Simple File Sharing in XP Pro gives it similar behavior to XP Home: the Shared Documents folder (usually at C:\Documents and Settings\All Users\Documents) is given NTFS permissions that allow all its contents to be read by everyone and modified by their creators, and exposed to the network as a share called \\%COMPUTERNAME%\SharedDocs with Full Control permissions for Everyone; Windows ignores the credentials of connecting users and uses its inbuilt Guest account for folder access instead.
With Simple File Sharing turned off, you get to define your own shares and Windows will grant access only when given a username and password that match a user account on the computer doing the sharing; that user account needs appropriate permissions set both on the share itself and the NTFS folder that backs it. Access to the default administrative shares (e.g. \\%COMPUTERNAME%\C$ or \\%COMPUTERNAME%\ADMIN$) requires a user account in the Administrators group.
User accounts with blank passwords can't be used for share access unless you tweak a policy setting. If any of your administrative accounts have blank passwords, tweaking that setting allows malware running on any computer on your LAN to do anything it likes to your computer via psexec, and is generally considered poor form.
posted by flabdablet at 6:52 AM on September 2, 2011
XP Pro has hidden administrative shares set up on the root folders of all drives by default (can't remember if this goes away with Simple File Sharing or not); XP Home doesn't.
Turning on Simple File Sharing in XP Pro gives it similar behavior to XP Home: the Shared Documents folder (usually at C:\Documents and Settings\All Users\Documents) is given NTFS permissions that allow all its contents to be read by everyone and modified by their creators, and exposed to the network as a share called \\%COMPUTERNAME%\SharedDocs with Full Control permissions for Everyone; Windows ignores the credentials of connecting users and uses its inbuilt Guest account for folder access instead.
With Simple File Sharing turned off, you get to define your own shares and Windows will grant access only when given a username and password that match a user account on the computer doing the sharing; that user account needs appropriate permissions set both on the share itself and the NTFS folder that backs it. Access to the default administrative shares (e.g. \\%COMPUTERNAME%\C$ or \\%COMPUTERNAME%\ADMIN$) requires a user account in the Administrators group.
User accounts with blank passwords can't be used for share access unless you tweak a policy setting. If any of your administrative accounts have blank passwords, tweaking that setting allows malware running on any computer on your LAN to do anything it likes to your computer via psexec, and is generally considered poor form.
posted by flabdablet at 6:52 AM on September 2, 2011
Windows 7 really doesn't like to access things from other computers. It is a constant thorn in my side.
Right click the folder, select Properties>Security, and fiddle with stuff there (punch in your account name, check all the permissions, etc.), then go into Properties>Sharing and fiddle with that, too. Then close all that up and right click the folder again, this time selecting Share With>Everybody.
That usually works for me--so well, in fact, that I kind of wonder if the 'security' of this 'feature' relies entirely on the bad guys being lazy and incurious.
posted by Sys Rq at 7:46 AM on September 2, 2011
Right click the folder, select Properties>Security, and fiddle with stuff there (punch in your account name, check all the permissions, etc.), then go into Properties>Sharing and fiddle with that, too. Then close all that up and right click the folder again, this time selecting Share With>Everybody.
That usually works for me--so well, in fact, that I kind of wonder if the 'security' of this 'feature' relies entirely on the bad guys being lazy and incurious.
posted by Sys Rq at 7:46 AM on September 2, 2011
Response by poster: Huh.
I have XP Pro SP3, and on that, I went through the network set up wizard. I'm not running any sort of Norton on either machine.
In the meantime, I've been able to drag everything to the Shared Documents folder on the XP machine. That one somehow is getting permission, but my regular My Documents Folder can't be shared.
As for taking ownership, I went through those levels and I don't have permission to take ownership. Oh, well.
As you're all saying , it could be a half-million things that I'm not seeing. For the time being, the shared documents folder will have to do.
Thanks!
posted by droplet at 5:01 AM on September 3, 2011
I have XP Pro SP3, and on that, I went through the network set up wizard. I'm not running any sort of Norton on either machine.
In the meantime, I've been able to drag everything to the Shared Documents folder on the XP machine. That one somehow is getting permission, but my regular My Documents Folder can't be shared.
As for taking ownership, I went through those levels and I don't have permission to take ownership. Oh, well.
As you're all saying , it could be a half-million things that I'm not seeing. For the time being, the shared documents folder will have to do.
Thanks!
posted by droplet at 5:01 AM on September 3, 2011
Best answer: OK, so it looks like what you're experiencing is covered by Microsoft's favorite explanation for Windows annoyances: "This behavior is by design".
At some point you will probably want to read kb304040 and kb307874.
If you end up hand-crafting permissions, you will need to know that (a) access to shared folders can be restricted by both share permissions and NTFS permissions and (b) with Simple File Sharing turned on, the user account associated with access via shares is always Guest (which is a member of the Everyone security group but not the Users or Administrators groups).
posted by flabdablet at 6:06 PM on September 3, 2011 [2 favorites]
At some point you will probably want to read kb304040 and kb307874.
If you end up hand-crafting permissions, you will need to know that (a) access to shared folders can be restricted by both share permissions and NTFS permissions and (b) with Simple File Sharing turned on, the user account associated with access via shares is always Guest (which is a member of the Everyone security group but not the Users or Administrators groups).
posted by flabdablet at 6:06 PM on September 3, 2011 [2 favorites]
Response by poster: Thanks, flabdablet! kb307874, just might do the trick!
posted by droplet at 7:08 PM on September 4, 2011
posted by droplet at 7:08 PM on September 4, 2011
If I'm setting up a peer-to-peer office LAN, turning SFS off is generally the way I'll do it. Provided all the computers involved have matching sets of usernames and passwords defined, it actually works pretty well.
Once you have more than about five computers and/or five user accounts, though, you're better off adding a domain controller to the network and centralizing things. Samba works, if you don't feel like paying MS prices for a server edition of Windows.
posted by flabdablet at 7:32 PM on September 4, 2011
Once you have more than about five computers and/or five user accounts, though, you're better off adding a domain controller to the network and centralizing things. Samba works, if you don't feel like paying MS prices for a server edition of Windows.
posted by flabdablet at 7:32 PM on September 4, 2011
Also, if you're going to be turning SFS off and setting permissions, I've generally found it convenient to use Full Control for Everyone permissions consistently on all shares, controlling access solely via NTFS permissions on the underlying folders and files. NTFS permissions can be (but don't need to be) much more fine-grained than share permissions, and having one place where permissions are defined avoids confusion and makes maintenance easier.
posted by flabdablet at 7:38 PM on September 4, 2011
posted by flabdablet at 7:38 PM on September 4, 2011
« Older employment, careers, depression, and inpatient... | My father is turning our company into a woo... Newer »
This thread is closed to new comments.
posted by fake at 7:14 PM on September 1, 2011