Windows Sync and User Security

20 Nov 2006 12:12 AM

Andrew Shadid

I am using a windows XP pro laptop in workgroup mode to connect to a windows
2003 domain. On the laptop I have two accounts "Account_A" And "Account_B"
No user switching is enabled.
On the server I have the same two accounts with the same respective
passwords as the laptop. The server has two shares: "share_for_A" and
"share_for_B".
User "Account_A' is the only one allowed to get to "share_for_A" and
"Account_B" is the only one allowed to get to "share_for_B". Simple. OK.
When I login to the laptop as "Account_A" and sync the contents of
"share_for_A"
everything goes fine. When I login as "Account_B" to the laptop then I can
access the contents of "share_for_A" on the server but NOT "share_for_B".
When I disable sync and reboot on the laptop security access goes back to
what should be expected.
Any Ideas?? Clues? Fixes? I paid Microsoft for this one but they have not
solved it in 2 months. This appears to be a major security problem.

Cheers

Andrew

20 Nov 2006 3:08 PM

Lanwench [MVP - Exchange]

In news:5EA4B478-2055-4020-9A0F-0849FCCD4F21@microsoft.com,

Andrew Shadid <andrewsha***@ashadid.com> typed:
Show quoteHide quote

> I am using a windows XP pro laptop in workgroup mode to connect to a
> windows 2003 domain. On the laptop I have two accounts "Account_A"
> And "Account_B" No user switching is enabled.
> On the server I have the same two accounts with the same respective
> passwords as the laptop. The server has two shares: "share_for_A" and
> "share_for_B".
> User "Account_A' is the only one allowed to get to "share_for_A" and
> "Account_B" is the only one allowed to get to "share_for_B". Simple.
> OK. When I login to the laptop as "Account_A" and sync the contents of
> "share_for_A"
> everything goes fine. When I login as "Account_B" to the laptop then
> I can access the contents of "share_for_A" on the server but NOT
> "share_for_B". When I disable sync and reboot on the laptop security
> access goes back to what should be expected.
> Any Ideas?? Clues? Fixes? I paid Microsoft for this one but they have
> not solved it in 2 months. This appears to be a major security
> problem.
>
> Cheers
>
> Andrew

My first question is, if you're accessing a Windows domain, using XP Pro,
why do you not want to join the computer to the domain so you can log into
the domain & not have to pass credentials to access resources on it?

My second question is - what's your overall goal here?

Anyway - when you try to access share_for_b while logged in as B - what
errors do you get? And what are the permissions on the share_for_a and _b
folders on the server - both in the share properties and the NTFS
properties?