Local Admin access to domain shares

[fiza]

Built a Windows 10 machine and when logged on as local admin and go to run and type "\\servername\share$" I can get to that share without being asked for credentials.

Whenever I have tried to connect to a domain share when logged on locally on a Windows 7 machine it always pops up with the authentication box.

 

Has something changed or am I missing a setting?

[Chaniel]

Possibilities;

 

Cached credentials (check Credential Manager, rundll32.exe keymgr.dll, KRShowKeyMgr, restart machine to clear memory)

Share/NTFS settings are incorrect - Access available to "Everyone" would allow access to non-domain users.

Edited June 25, 2019 by Chaniel

[MatthewL]

Does you Windows 10 local admin account have the same password as your file server?

[fiza]

Possibilities;

 

Cached credentials (check Credential Manager, rundll32.exe keymgr.dll, KRShowKeyMgr, restart machine to clear memory)

Share/NTFS settings are incorrect - Access available to "Everyone" would allow access to non-domain users.

 

The laptop has just been built. Has been rebooted. NTFS permissions are correct as we have checked and Windows 7 machines ask for credentials.

[fiza]

Does you Windows 10 local admin account have the same password as your file server?

No it doesn't

[Arthur]

On your Windows 10 PCs do you have a GPO that sets LocalAccountTokenFilterPolicy to 1?

 

[fiza]

On your Windows 10 PCs do you have a GPO that sets LocalAccountTokenFilterPolicy to 1?

 

 

Where is that setting found please @Arthur?

[Arthur]

Where is that setting found please?

Download the latest Microsoft security baseline from here, extract the files and copy SecGuide.admx from the Templates subfolder to your Group Policy central store and SecGuide.adml to the en-US subfolder in your central store.

 

You will then find the policy pictured above under Computer Configuration > Admin Templates > MS Security Guide.

[fiza]

Download the latest Microsoft security baseline from here, extract the files and copy SecGuide.admx from the Templates subfolder to your Group Policy central store and SecGuide.adml to the en-US subfolder in your central store.

 

You will then find the policy pictured above under Computer Configuration > Admin Templates > MS Security Guide.

 

So is this an additional ADMX file I have to download? If so then as I havent downloaded it then surely I wouldnt have the setting you mention set to 1?

[Arthur]

So is this an additional ADMX file I have to download?

It is.

 

If so then as I haven't downloaded it then surely I wouldn't have the setting you mention set to 1?

The setting can also be changed via the registry/GPP. It's normally 0 (Enabled) by default.

 

Perhaps it might be worth checking what the value of LocalAccountTokenFilterPolicy is under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System on your Windows 10 PC first.

[fiza]

It is.

 

 

The setting can also be changed via the registry/GPP. It's normally 0 (Enabled) by default.

 

Perhaps it might be worth checking what the value of LocalAccountTokenFilterPolicy is under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System on your Windows 10 PC first.

@Arthur - I checked that location and there is no "LocalAccountTokenFilterPolicy" setting there!!