1

I got a system error 5 while mapping a network drive of a server to my local machine using the net use command.

This error doesn't occur when I use Administrator account of the server. When I use my user account the net use command gives system error 5.

But, my user account is added to the Administrators group on the server. Can you please help me with this?

rboorgapally
  • 233
  • 2
  • 5
  • 18

7 Answers7

3

Here's a helpful hint re: those error messages: If you ever need to diagnose error messages from the "NET" command, just go a "NET HELPMSG ". Like, for example:

C:\Documents and Settings\w00tw00tw00t>net helpmsg 5

Access is denied.

C:\Documents and Settings\w00tw00tw00t>

So, you're getting an "Access is denied".

What's the share you're trying to access? Are you seeing anything in the "Security Log" on the server computer re: failures?

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
3

I'm assuming that both of these systems are not joined to any domains. Windows Vista Home Premium cannot be joined to a domain so you are definitely dealing with a scenario where this might apply. If the Windows 2008 Server was part of a domain then I don't think you would be able to connect (to the administrative shares) at all from a non domain joined system unless you had made some changes to the default security settings.

UAC on Windows Server 2008 by default prevents access to administrative shares from non domain joined systems using credentials that are part of the administrators group even though the explicit permissions appear to allow it. See this KB article for details on how to work around this.

Use of the explicit Administrator credentials means that you get a different behaviour than when you connect (or attempt to connect) using a credential that is simply a member of the administrators group. The default behaviour of UAC on non-domain member systems enables full privilege elevation when you connect with the built in Administrator account but does not do this for accounts that are members of the Administrators group. That reference is for Vista but I'm pretty certain the same default applies to W2K8 when in workgroup mode.

Helvick
  • 20,019
  • 4
  • 38
  • 55
  • The server 2008 system is not part of any domain. – rboorgapally Oct 08 '09 at 20:26
  • That would be the problem then - the default behavior treats the explicit Administrator account differently to members of the Administrators group. If you disable UAC (on the W2K8 server) does the behavior change? If you need to change the beahviour then my advice is to follow the instructions in the linked KB article and re-enable UAC. – Helvick Oct 08 '09 at 23:49
2

Check the share permission. Just because the account is in the administrators group does not necessarily mean it has permission to access the share. Assume nothing.

John Gardeniers
  • 27,458
  • 12
  • 55
  • 109
1

use the runas command 

runas /user:administrator "net share sharename=driver:\path"
Falcon Momot
  • 25,244
  • 15
  • 63
  • 92
Pieter
  • 31
  • 2
1

rboorgapally, just to expand on John Gardenier's thought, check to see if your account or any group that your account is a member of has any explicit deny permissions assigned to it for those shares. Deny permissions supersede all allow permissions in all cases.

Wesley
  • 32,690
  • 9
  • 82
  • 117
  • The shares I am accessing are default administrative shares (C$, D$ etc). I do not think any one is allowed to modify the permissions for these shares. – rboorgapally Sep 24 '09 at 15:36
  • I think it's possible using a registry hack. TweakUI can purportedly do this for an XP machine, but I'm not sure if it can work on a Windows Server OS. Besides, I hope no one is using Tweak UI on your server... =) I suppose that later on we can check the proper regkeys to see if someone (or something...) has edited the default values. For now, check the NTFS permissions on the shares' target folder. E.g. for C$ check the NTFS permissions for C, etc. Once again, see if any groups that your account is a member of or your user account itself has a deny permission. – Wesley Sep 24 '09 at 16:02
0

also, beware the deny in windows shares...a deny for the Everyone group will prevent other permissions from working correctly

Greeblesnort
  • 1,759
  • 8
  • 10
0
  1. Assume nothing
  2. go over all security properties of the share,
  3. go over all security properties of your account
  4. check what credentials are known to the server as it is not in the domain

When I've had such problems in two-PC network, I made sure that there is an account with the same username and password on both computers and it has to be logged in on the client (the one issuing net use) computer.

slovon
  • 957
  • 5
  • 12