2

This is not a duplicate question. Please read thoroughly and completely before closing it. Similar questions or their solutions either are related to AD or did not work. Having said this:

I have two PCs, PC-local and PC-remote. Both are running Windows 10 Enterprise. Both are connected via TCP/IP; the network runs without issues.

On both PCs, I have enabled the built-in Administrator account and have assigned it the same password. On PC-remote, I additionally have a local user RemoteUserA who does not belong to PC-remote's Administrators group.

On PC-remote, I have a directory C:\level1\test and have configured C:\level1's security permissions recursively so that PC-remote's built-in Administrator account has full access to it. On PC-remote, I have shared the C:\level1 folder so that Administrator has full access to it; that share's name is level1 so that I can reach the share from PC-local using the UNC notation \\PC-remote\level1.

There is no Active Directory in place. Both PCs have different PC names of course, but the workgroup name is the same (it is WG1).

Now I want to configure the permissions of PC-remote's folder C:\level1\test via network from PC-local's console. To do that, on PC-local, I perform the following steps:

  • I log into PC-local as Administrator;
  • I start Windows Explorer;
  • I type \\PC-remote\level1 into Windows Explorer's address bar (it then lists the contents of that share as expected);
  • I left-click on test in the lists of files and folders which are in the share;
  • I right-click on test and choose Properties from the context menu, then choose the "Security" tab, then click "Edit ...", then click "Add ...", then click "Advanced ...", and finally click "Find Now".
  • To my surprise, a new dialog opens where I need to enter a user name and a password again. I have no clue why this happens, but obviously I am not going anywhere without it, so I enter Administrator and the administrator account's password again.
  • In the search results area, some built-in security principals are listed (as far as I can tell, only groups). The local users of PC-remote, notably RemoteUserA, are not listed.

Now I have two questions:

  1. Which credentials should I enter into that additional dialog box (next-to-last list item above), and why does that dialog box appear?

  2. What do I need to do to have PC-remote's local users listed in the search results (last list item above)?

Until now, I didn't have that problem because I always have adjusted permissions via Remote Desktop, where both problems do not arise. This is the first time that I need to tailor permissions only using shares.

Of course, I have read a lot of similar questions and answers. Most of them related to situations where an AD was involved, so I can't use (not even test) the respective solutions. The remaining questions didn't have solutions, or the solutions given didn't work.

What I have tried so far:

  • In credential dialogs, I have given PC-remote\Administrator or PC-local\Administrator as user name;
  • In credential dialogs, I have given WG1\Administrator as user name.

That didn't change anything.

Binarus
  • 1,687
  • 9
  • 19
  • On both PCs, I have enabled the built-in Administrator account and have assigned it the same password. .... Why? Not a good strategy. Disable the built-in Administrator, set up proper Admin accounts and then try again. To change permissions remotely, I just RDP to the other machine and change on that machine. Otherwise, use SysInternal PSexec. – John Sep 01 '22 at 14:53
  • 1
    When the login-popup appears you need to enter the administrator credentials for the remote PC. Use "remote-pc\Administrator" to explicitly force the use of the remote PC's Administrator account. Even though both accounts are called Administrator and have the same password they are separate identifies and neither PC has knowledge of the other PC's accounts. – Tonny Sep 01 '22 at 15:02
  • @John I've followed your advice (set up other admin accounts), but that didn't change anything. Unfortunately, as explained in my question, I can't use RD in that case. I also can't use PSexec. My gut feeling is that I may have to enable some GPOs on the server to let it enumerate user accounts over the network, but I haven't found it yet. – Binarus Sep 06 '22 at 09:34
  • @Tonny Thanks for the explanation, and +1. At least it is now clear why that second credential dialog pops up. However, whatever I enter there (`WG1\Administrator` or `PC-remote\Administrator`) doesn't change things. My gut feeling is that I may have to enable some GPOs on the server to let it enumerate user accounts over the network, but I haven't found it yet. – Binarus Sep 06 '22 at 09:36

0 Answers0