DFS permission issues

[ADMaster]

Hello all,

A bit of background, we have a program that relies on a file share for a shared access database.

The share was on server 2016 file server and accessed via dfs.

The manager program runs on a win 10 machine pointing to the dfs path.

Clients also run on win 10 pointing to the dfs path.

 

Due to performance ( really need a san but that's another topic), I moved the file share to the manager machine and re targeted dfs.

 

The clients can access the program just fine, the manager gets accessed denied. However the manager can access the files by going direct to the share or locally.

 

The quick fix would be to point the manager to the local path, but I'd like to fix it properly.

 

From the win10 machine;

\\namespace\target access denied

\\win10\target works

 

share permissions are everyone full control, NTFS permissions are administrators, system and program users full control.

 

I suspect there is something in windows 10 / client OS that doesn't allow it to access dfs name space to itself.

 

I setup another DFS target to a share on my own machine and it gave the same results. I even gave everyone full control.

However if I go to the server 2016 file server I can access the dfs targets just as a client would.

 

Thank you,

[Steve21]

By default DFS blocks loopbacks, but you can enable it with a regfix EnableDfsLoopbackTargets not sure it's a win10 issue though as pretty sure that's always been the case unless you have another problem?

 

Steve

[ADMaster]

I found a site that then linked back to a technet article, read the blue note section.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753448(v=ws.10)

 

Loopback is permitted on servers by default, but not clients. I've never tried to target a client until now.

 

With only 6 clients I shouldn't hit any SMB concurrent connection limit.

I know this ins't the best practice, but its a stop gap until the software gets replace with the hosted version next year.

 

Thanks again Steve, searching the correct terms allowed me to find it.

Edited June 28, 2018 by ADMaster

[mtillbrook]

DFS

 

Kill it with Fire!

 

I hate DFS with a passion. I've used it windows Svr2003 and it's still just as bad as it was then! My advice - get rid of it!

[ADMaster]

DFS

 

Kill it with Fire!

 

I hate DFS with a passion. I've used it windows Svr2003 and it's still just as bad as it was then! My advice - get rid of it!

Why I've never really had an issue with it. I've been using it since server 2008. I recommend everyone use it for consistent paths. I don't recommend the replication bit that can cause problems. But using it as a namespace keeps all paths the same. I've migrated our file server from physical 2008 to 2012 r2 virtual then to 2016 virtual all with no disruption to users.

[mtillbrook]

fair enough - its the replication bit that's always caused me pain!