Effective Access check fails with error about Netlogon Service Authz

Question

Background: from a file's properties menu, I'm on the Security -> advanced window, and on the "Effective Access" tab. I want to check to see if a user has any sort of existing access to this file. I'm doing the check while logged in as the domain admin, to a domain controller. I'm connecting to a network drive share on a different file server. Whatever use I try to run the check for, I get the following error - "The RPC Server is unavailable. Please enable the Netlogon Service Authz (RPC) firewall rule on the target server and try again."

I noted that on my domain controller GPO for firewalls, I had not enabled this rule inbound. So I turned it on, and refreshed GP on the domain controllers. The error continues when I try to check for effective access.

So, what is the "target server" that the message is telling me about? Do I need to make the change on the file server nodes that contain the file? A quick search finds almost no information on this.

Answer 1

Hi md5hash,

Thank you for your question.

As per my understanding, you tried to view effective access of a file shared on your remote file server from your domain controller as domain admin. Please correct me if there’s any misunderstanding.

I did some tests on my servers and I could view effective access of a remote shared file as domain admin. Could you help to log on your file server and check if you could open the effective access locally?

As the error message indicated, you could open Windows Firewall with Advanced Security on your remote server and enable the firewall rule “Netlogon Service Authz (RPC)” on your file server. You could also try to temporarily disable the firewall if the error is still the same.

To fix the error RPC server is unavailable, you may refer to the article below
https://social.technet.microsoft.com/wiki/contents/articles/4494.windows-server-troubleshooting-rpc-server-is-unavailable.aspx

Best Regards,
Ian

----------

Please remember to "Accept Answer" if the reply is helpful.

Answer 2

Yes, opening that built-in firewall rule on our file server cluster nodes has definitely improved things. I can now see some Effective Access results. Get a new error, "The share security information is unavailable and was not evaluated for effective access" now when I browse via mapped drive letter, but I don't get that error when I go to the same location via UNC path. Similar to what's being described here.

Any ideas as to what can cause that error?

Answer 3

Hi md5hash,

I reproduced this issue via a mapped drive on my Windows Server 2019. This could be caused by the missing of the share security descriptor when a remote call is made to evaluate the effective access.

But unfortunatelly there seems to be no software update solution to it yet. So, in order to avoid this problem, you need to make sure you access the server location through an UNC path.

Best Regards,
Ian

---

Please remember to "Accept Answer" and upvote if the reply is helpful.