Windows is asking for credentials when using DFS-path but NOT when direct access

Question

Hey community,

strange things happen...

I have a single 2019 windows-server which is hosting a fileshare named "IT-Support". There are 2 groups permitted (group A and group B...in sharing options and NTFS permissions as well). The share is available via dfs-path \domain.local\IT-Support and directly via \FILESERVER01.domain.local\IT-Support.

When I access this share from a workstation where I'm logged on with my user "A" (which is member of group A) everything is working fine!
If I try to access the same share from a workstation where I'm logged on with my user "B" (which is member of group B) windows is asking for credentials and if I present the credentials for user "B" it says "access denied" (even the user has access!). If I present the credcentials of user "A" i can access the fileshare.

Its totally weired and I have no idea why user "B" cannot access the fileshare...

Any ideas?
Cheers
Miranda

Answer 1

Hello @MirandaVeracruz

First, I would check what other memberships the users have, as there may be a winning Deny permission:

Get-ADUser username -Properties Memberof | Select -ExpandProperty memberOf

Then I would check with the ACL of the share that is being accessed, for example:

Get-Acl -Path D:\share\IT-Support | Format-Table -Wrap

Most likely there is a difference in the permissions or memberships that is preventing user B from accesing.

Hope this helps with your query,

--If the reply is helpful, please Upvote and Accept as answer--