Re: File and printer sharing suddenly broken

Yet you get "access denied" error message?? What did the net command show?
You probably used net sessions maybe? I would again verify that everyone has
share and NTFS permissions to the folder you want to access and make sure
there are no deny permissions on that folder for share or NTFS. It
definitely sounds like you have network connectivity to computer "victim".
Try the command net config server to make sure that "server is active" as
shown in the example below. --- Steve

D:\Documents and Settings\Steve>net config server
Server Name \\STEVE-XP
Server Comment

Software version Windows 2002
Server is active on
NetbiosSmb (000000000000)
NetBT_Tcpip_{19C66C86-CB8F-40CF-95C3-E6E755957325} (000795ec77ca)


Server hidden No
Maximum Logged On Users 10
Maximum open files per session 16384

Idle session time (min) 15
The command completed successfully.


"jeffr" <jeffr@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C687CD12-24EC-489E-A460-A856E7542209@xxxxxxxxxxxxxxxx
There are no logon failures. In fact, there is a logon success from the
connecting computer using the guest account and that is followed
immediately by an assignment of the SeChangeNotifyPrivilege.
I was playing around on victim with the net commands and I stumbled
upon one that showed that there was even a connection open from the
other machine as guest. Indeed, victim shows that the guest account
is active. I can ping victim by name and by IP address. I can telnet
into port 139 and get the static screen with the blinking cursor, just as
you described. It just seems that whatever the first thing is that is
being
accessed, guest does not have enough permissions for the access.
But what would that be?

Jeff


"Steven L Umbach" wrote:

Do you see any logon failures in the security log at the same time when
you
try to access the share and get the access denied message?? Does it show
that the guest account is active on the problem computer as it needs to
be?
Make sure you can ping the problem computer by name an IP address from
the
computers that want to access the share. Try to access "victim" by it's
IP
address rather then name by using \\xxx.xxx.xxx.xxx in the run box of the
computer you are trying to access it from. When you run the command
netstat -an you should see ports 139 TCP and 445 TCP listening on
"victim"
computer. If that is the case see if you can telnet into port 139 TCP to
see
if that works. From a computer where you want to access the share use the
command telnet xxx.xxx.xxx.xxx 139 using the IP address of "victim" . If
the port is open and available from the client computer you will get a
blank
command screen with a blinking cursor. If none of that pans out try
using
the netsh command to reset tcp/ip on "victim" as shown in the link below.
Doing so will make it a DHCP client however just in case you are using
static IP address. You can use ipconfig /all to check the tcp/ip info
before
and after. -- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;299357

netsh int ip reset c:\resetlog.txt

"jeffr" <jeffr@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:19416BF5-57C3-42AC-AEF0-0C4681253BE9@xxxxxxxxxxxxxxxx
Thanks for the quick and very insightful response.
Here's what I found:

1. "net user guest" reports the same info on the working
Windows XP Home system as on victim, namely that the
guest count exists. I assumed it would be since I no longer
get a Failure Audit logon event when the remote machine tries
to access victim.

2. Windows firewall is indeed disabled.

3. There is nothing in the event log that looks useful to me.

4. net share looks the way you describe it should.
I created a new shared modifiable folder and then rebooted in
Safe Mode with Networking. The NTFS permissions for the
Everyone group has Modify, Read & Execute, List Folder Contents,
Read, and Write, while the share permissions for
the Everyone group has Read and Change (but
not Full Control). Again, I got Access is denied when I
tried to look at \\Victim

5. I have an up-to-date Norton Antivirus and have done a full
scan in both regular and Safe Mode with nothing found.

Any ideas what to look at next?

Jeff

"Steven L Umbach" wrote:

Verify that the guest account is active. You can use the command net
user
guest to see if it is and if not use the command net user guest
/active:yes
.. Verify that the Windows Firewall is disabled or has the exception
for
file
and print sharing enabled for your network though I don't think that
is
the
main problem sine that usually generates a "not found" message. I
would
also
look in the application/security log via Event Viewer to se if
anything
is
recorded there that may be of help. The command net share should show
that
the $IPC share is available and the share you are trying to access
needs
permissions for the everyone group for both share and folder [NTFS]
permissions. The link below can show you how to check those
permissions.
Since you are experiencing unusual unexplained behavior you should
also
scan
for viruses and spyware in regular and Safe Mode being sure to use the
latest definitions for any program you use to do such. I would also
try
booting into Safe Mode with networking to see if that makes any
difference
or not in case some process/application [legitimate or otherwise] is
interfering. If you do not have an "internet router" or firewall
device
protecting your network I would disconnect from the internet before
booting
into Safe Mode with networking. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308418
http://www.microsoft.com/downloads/details.aspx?FamilyID=fd7fd48d-6b4a-448e-a632-076f98a351a2&DisplayLang=en
--- White paper on troubleshooting sharing in XP.


"jeffr" <jeffr@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:78E5D434-3E4F-4F8E-B639-75D3F53654E7@xxxxxxxxxxxxxxxx
I have a home network with four PCs. Two are Windows XP Home and two
are
Media Center. One of the Windows XP Home machines (call it
"victim")
shares
a folder and printers. All other machines have been able to print
on
that
printer
for a long time. Then, last week, none of the machines could print
on
that
printer
any more. Clicking on "victim"'s name in Windows Explorer caused an
error
message that said that login on that machine failed. "Victim" is
running
Norton
Internet Security and I tried various things with that to no avail.
After
much
research, I found two things. First, (this is not relevant to the
problem
but is
strange) I found automatic updates turned off when I know I left it
turned
on.
Second, looking at the event log and other posts here, I figured out
that
the
security rights had been messed up. I downloaded Dumpsec and
NTRights
to both Windows XP Home machines and compared rights. "Victim" was
missing all its SeNetworkLogonRights entries. Using NTRights, I
copied
some of the entries from the other machine, namely BUILTIN\Users and
VICTIM\Guest. Now, I still can't access "victim" remotely, but it
doesn't
complain about a logon failure. Instead it says "Access is denied".
Since the event log now looks the same on victim as on the other
machine
(shows a network logon using the guest account followed by a
SeChangeNotifyPrivilege assigned to VICTIM\Guest) and there are no
more
Failure Audits, I have no clue what to do next.








.

Relevant Pages

  • Re: ubuntu-users Digest, Vol 47, Issue 208
    ... Superuser confusion or maybe critically confused ... "Permissions" appears nowhere in Nautilus, so far as I can tell. ... I am attempting to learn to use command line. ...
    (Ubuntu)
  • Re: Isolate home directory shares
    ... I believe the command for one subfolder would be similar to: ... removes the inheritance flag but leaves existing permissions for the ... home directories are done with ADUC using profile tab: ...
    (microsoft.public.windows.server.general)
  • Re: File permissions?
    ... have to do it with root permissions, unless you want to change the ... This will open gedit with MyFile and the terminal isn't locked to it ... This redirects the output of the free -m command to the file MyFile. ... Personally I created my own alias ...
    (Ubuntu)
  • Re: File permissions?
    ... have to do it with root permissions, unless you want to change the ... This will open gedit with MyFile and the terminal isn't locked to it ... This redirects the output of the free -m command to the file MyFile. ... Personally I created my own alias ...
    (Ubuntu)
  • Re: 2 pc network - cant see host files from pc 2 on pc 1
    ... > Enable it on both computers and use the command ipconfig /all to make sure ... > permissions. ... > user account and/or change the password for a user account. ... It continuously states the windows ...
    (microsoft.public.windowsxp.security_admin)