Can a Domino Java Agent write to a network location without using a mapped drive letter?

Question

I am writing a java agent that needs to write a file to a share drive using UNC format (\\servername\directory\subdir\etc).

I am getting "access denied" returned by the agent. The same code will write to the D drive of the same machine using either the D:\ or the UNC format.

I believe that this is a security limitation of Notes and that this can't be done, but hope I am wrong. Does anyone know of a way around this???

Security policy prohibits using FTP, and mapping a drive letter.

I have tried Apache commons FileUtils with no success, as well as just trying to create a File object.

(Note: not tagging java because I need notes specific answers, and tagging XPages even though it is not because the smart people hang out there)

It is taking me a while to get the right people to verify the windows policies. If anyone else has any other ideas, please chime in. — Steve Zavocki, Mar 18 '19 at 20:34
As @umeli mentioned, you have two options: change the policies for the Local System account (bad idea; your admins should not let you do this!) or change the settings for the Domino service to run under the login of a service acccount. Policies can be set to allow the serivce account to access the network, and the owner of the share can grant access to the service account. https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/service-accounts — Richard Schwartz, Mar 19 '19 at 01:48

score 3 · Accepted Answer · answered Mar 18 '19 at 16:51

3

This depends on global or local policies for the windows account which runs the domino server. Normally this is local system. Local System does not have access to mapped drives. Either change the service account which runs domino or give the privileges to the local system account.

answered Mar 18 '19 at 16:51

umeli

1,068
8
14

Thx, I am going to have the Notes Admin check these policies. – Steve Zavocki Mar 18 '19 at 17:01
umeil, I don't want access to mapped drives per say, I want access to any network share. Is that the same privilege? (also what does GPO stand for?) – Steve Zavocki Mar 18 '19 at 18:08
UNC or mapped -> follows the same access rule restriction. The service account is a popular trip over – stwissel Mar 19 '19 at 00:56
GPO = "Group Policy Object" – Richard Schwartz Mar 19 '19 at 01:43
Thanks all. It appears that some time ago, the admins did edit the local account policies to get past the restriction. The share did not have the permission granted properly. I can now write to the shared location now. – Steve Zavocki Mar 19 '19 at 15:10

Can a Domino Java Agent write to a network location without using a mapped drive letter?

1 Answers1