access DFS root from workgroup client

Question

are there any tricks to access domain DFS root from a workgroup computer (ie use case being AAD joined machine talking to domain DFS), using \domain\dfsroot path? the issue is with dfsroot component (i can trick the DNS resolution but not sure how to get the client to "resolve" dfsroot)

Answer 1

Hi @Walter Wodzien ,

In order to access a DFS namespace your server will have to be either part of the domain or in a domain that has a trust relationship with the domain the DFS namespace is in.

Here's a similar thread:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/c3214a4c-8088-446c-ba4d-643d5baf87cc/how-to-access-dfs-namespace-from-a-standalone-windows-2003-server?forum=winservergen

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Best regards,
Leon

Answer 2

Hi,

Thanks for posting in Q&A platform.

I have tested in my lab and workgroup client can access the DFS Root successfully.

As a workaround, you can access DFS Root from non-domain joined computer via the following detailed steps.

From target server side:

A. Enable guest account in the control panel – user accounts. Please do not setup a guest password.

B. Locate to the registry [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA], please configure the value of restrictanonymous is 0 and forceguest is 1, and then reboot the server.

C. Open Local Group Policy Editor and locate to the following policies:

Computer Configuration->Windows Settings->Security Settings->Local Policies->User Right Assignment->Access this computer from the network, please ensure Everyone group was listed here

Computer Configuration->Windows Settings->Security Settings->Local Policies->User Right Assignment->Deny access to this computer from the network, please ensure “Guests ” and “Anonymous Logon” group were not listed here

Computer Configuration->Windows Settings->Security Settings->Local Policies->Security Options->Network access: Let Everyone permissions apply to anonymous users->Enable

D. Configure the NTFS permission and share permission in the properties of shared folder on target server for Everyone group:

From the non-domain joined computer side, add the DNS suffix for this client with the specific domain name.

And now we can access the DFS root from the non-domain joined computer:

And here is a similar thread discussed before, you could also try the method in this thread:

Access to DFS Namespace Target from Non-Domain Member Client Computer

Best Regards,
Sunny

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

@Anonymous , thank you kindly for your extended response. However, how does a Windows computer in a workgroup get to "resolve" the dfsroot part of the namespace (ie \domain\dfsroot\folder1)?