Permissions issue on netlogon

[Sheridan]

Something odd has started to happen with our netlogon\sysvol shares. As an administrator I can browse to the shares on any specific DC and edit files/copy files etc using the path \\server\netlogon. However when I try this using the domain path (i.e \\domain\netlogon) I cannot do this as I get access denied, despite being logged in as the same administrator. Replication across the DCs is OK - and I can edit the files on each server individually but not via the domain unc path - which is what we use in some scripts. Is there anywhere permissions on the domain unc could be different to the individual servers?

 

Edit: even more weird is that if I am logged on to server01 I can use the paths \\server02\netlogon, \\server03\netlogon etc to edit the files in the share, but not the server I am actually logged into, like \\server01\netlogon!

 

This can't be by design? There must be some permissions issue somewhere here

Edited September 22, 2022 by Sheridan

[locksat]

Sounds like you need to configure Hardened UNC Paths in a GPO. I found some articles going into more detail below:

 

https://help.univention.com/t/how-to-access-netlogon-share-of-other-school-or-domain-from-windows-clients/18743

Unable to Access SYSVOL and NETLOGON folders from Windows 10 | Windows OS Hub

 

We have it set in our domain's Default Domain Policy for the \\*\SYSVOL and \\*\NETLOGON shares (you can use wildcards) as RequireMutualAuthentication=0. I believe this is the crucial parameter that needs to be changed, the other 2 can be left alone at their default values i.e. by just leaving them out. It's worked fine for us ever since it was implemented in that manner.

Edited September 22, 2022 by locksat

[Sheridan]

I did have a look at hardened UNC paths, but they were set up by someone else 4/5 years ago and seem to be configured as per MS recommendations, similar to what you've posted as well

 

Its the odd combination I don't get - an admin on Server A can edit the netlogon folder via the path on Server B - but not Server A or the domain path, so permissions seem correct and we use the \\*\Netlogon and \\*\sysvol paths so its not limited to specific servers