Re: File and printer sharing suddenly broken

Suspiciously enough, System Restore doesn't go back far enough.
It was the first thing I looked at in the beginning and even at that
time, it didn't go back far enough. I tried the uninstall/reinstall file
and printer sharing as you suggested, but it didn't help. I tried
netsh to reset the TCP/IP stack and thaqt didn't help either. I will
consider the upgrade/repai install of the OS later if I can't think of
anything else. What I would really like to do is to enable auditing
on file and directory access and then see if I can get a log entry for
the access that is failing. I can turn auditing on for specific folders
and see what happens.

In any case, I want to thank you for all the effort you have generously
put in trying to solve my problem. Even though it is not yet solved,
I really appreciate what you have done.

Thanks again.

Jeff


"Steven L Umbach" wrote:

I am about out of ideas here. Since you have unexplained configuration
changes on your computer that could have been caused by malware there may be
something else going on that would not be so apparent. Try using System
Restore to restore your computer to a point in time before the problems
began. If that does not help or can not be done what I would try is to go to
networking properties, uninstall file and print sharing, reboot and install
it again to see if that helps or not. If you have not tried netsh to reset
tcp/ip try that. If that fails I would consider an upgrade/repair install
of the operating system and you would need your install disk for that and
after being done you would need to first install your service pack [if not
part of the install disk] and then go to Windows Updates to download all the
needed critical security updates. You also may want to post in the
Microsoft.public.windowsxp.network_web newsgroup to see if anyone there has
any ideas that we have not tried yet. Review the info in the link below if
you have not seen that yet. --- Steve

http://support.microsoft.com/default.aspx?kbid=308007


"jeffr" <jeffr@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D5DE2AA4-65E3-4566-8B64-5EB42C85B1CE@xxxxxxxxxxxxxxxx
I boot Victim into Safe Mode with Networking.
I go to computer Other and in Run, I type \\Victim
It says access is denied. I go back to Victim and in cmd I type
net config server. The output is:
Server Name \\VICTIM
Server Comment P4 2.8 GHz

Software version Windows 2002
Server is active on
NetbiosSmb (000000000000)
NetBT_Tcpip_{1D2790F6-7A41-4F41-9AF7-A434E1BDBFF4} (000c4113b946)


Server hidden No
Maximum Logged On Users 5
Maximum open files per session 16384

Idle session time (min) 15
The command completed successfully.

I start up Computer Management and open Shared Folders.
I click on Sessions and see:
User Computer Type # Open Files Connected Time Idle Time
Guest
JEFF OTHER Windows 0 00:00:15
00:00:14 Yes

I click on Shares and see:
Shared Folder Shared Path Type # Client Connections Comment
Documents C:\Docume... Windows 0
IPC$ Windows 1
Remote IPC
print$ C:\Docume... WIndows 0
Printer Drivers

I double click on Documents and look at
Share Permissions and see:
Everyone: Change, Read
I look at Security and see:
<other groups, other users>, Everyone: Modufy, Read & Execute,
List Folder Contents, Read, Write
I click advanced and see a number of lines including:
Everyone: Modify <not inherited> This folder, subfolders and file
I double click Everyone and see a long list of allowed permissions; they
are all checked except Full Control, Delete Subfolders and Files,
Change Permissions, and Take Ownership. The entire Deny column is
clear of check marks.

I enabled the guest account and logged in as guest (after a normal reboot)
just to make sure that guest had access to the shared documents folder
and it did. So why does guest get Access is denied when it is used to
logon
remotely?

Is there a way of turning on more auditing so that I can get something in
the event log when the Access is denied message is generated?

Jeff


"Steven L Umbach" wrote:

Yet you get "access denied" error message?? What did the net command
show?
You probably used net sessions maybe? I would again verify that everyone
has
share and NTFS permissions to the folder you want to access and make sure
there are no deny permissions on that folder for share or NTFS. It
definitely sounds like you have network connectivity to computer
"victim".
Try the command net config server to make sure that "server is active" as
shown in the example below. --- Steve

D:\Documents and Settings\Steve>net config server
Server Name \\STEVE-XP
Server Comment

Software version Windows 2002
Server is active on
NetbiosSmb (000000000000)
NetBT_Tcpip_{19C66C86-CB8F-40CF-95C3-E6E755957325} (000795ec77ca)


Server hidden No
Maximum Logged On Users 10
Maximum open files per session 16384

Idle session time (min) 15
The command completed successfully.




.