Click here to get back home

Windows Explorer changes user account during connection to share folder

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Windows Explorer changes user account during connection to share folder Kolja 02-15-2006
Posted by Kolja on February 15, 2006, 5:49 am
Please log in for more thread options
I noticed strange sitiation.
When I try to connect with Windows Explorer to share folder on another
computer in net. I know that my account doesn't have the permissions so the
connection must to fail but instead I got the connection established
nevertheless although shouldn't be.
Now I go to see on sharing computer its share sessions and what I see: the
session with the name of user which is not mine(!) but of another user on my
computer.
Then I check into the security audit and found that there are the failed
attempts of network logon with my user name. It is right since I don't have
the permissions.
But then next it goes the succesfull logon(!) with different name of local
user from my computer.
It seems like if Windows Explorer browse user accounts onebyone and try to
fit them to connection until success.
Why it does that? I think it is wrong. Rather it should to show me the
failure to connect them ask me about new user name. Where I can read about
it more?
Thanks.



Posted by Roger Abell [MVP] on February 16, 2006, 1:26 am
Please log in for more thread options
Are you sure you are not reusing a preexisting connection to the server
that has the share ?? Does this happen on that machine after a fresh
logoff/login ? If so, run a cmd window and enter net use
Are there any persistent connections showing ?
If the machine from which you are doing this is XP, has there been any
credential caching for the account you are using ? This is in the Users
control panel applet for the account in use while in use (network
credentials).

>I noticed strange sitiation.
> When I try to connect with Windows Explorer to share folder on another
> computer in net. I know that my account doesn't have the permissions so
> the connection must to fail but instead I got the connection established
> nevertheless although shouldn't be.
> Now I go to see on sharing computer its share sessions and what I see: the
> session with the name of user which is not mine(!) but of another user on
> my computer.
> Then I check into the security audit and found that there are the failed
> attempts of network logon with my user name. It is right since I don't
> have the permissions.
> But then next it goes the succesfull logon(!) with different name of local
> user from my computer.
> It seems like if Windows Explorer browse user accounts onebyone and try to
> fit them to connection until success.
> Why it does that? I think it is wrong. Rather it should to show me the
> failure to connect them ask me about new user name. Where I can read about
> it more?
> Thanks.
>



Posted by Kolja on February 16, 2006, 4:54 am
Please log in for more thread options
Thank you for your answer.
You are right my asking systwm was Windows XP and excatly as you said in its
credential cache there was the user/password which was used. When I deleted
the credentials form cache the system began to ask them explicitly.
The fact of matter was that that user account which I think the system used
was same on my asking computer and on asked computer. So I thought that the
system used the account from asking computer but really system just used
cached account of this asked computer which happened to be equal. It created
confusion for me.

But now I found another problem. If I successfully got connected to remote
computer through net by Explorer then Explorer kinds of remember the
successful credentials all times so that if I closes Explorer but later I
start Explorer try to open connection to same computer it uses same user
credentials again. Credential storage is empty since I didn't ask Windows to
save it during first user/password authentication.
I could break it by Windows restart. How to break it without restart? How to
force Explorer to ask credential again on each connection?
P>S. After first connection and then closing Explorer I see in "net use" the
connection to asked computer but with status: "disconnected". Maybe Exploler
just reuse this connection later?


> Are you sure you are not reusing a preexisting connection to the server
> that has the share ?? Does this happen on that machine after a fresh
> logoff/login ? If so, run a cmd window and enter net use
> Are there any persistent connections showing ?
> If the machine from which you are doing this is XP, has there been any
> credential caching for the account you are using ? This is in the Users
> control panel applet for the account in use while in use (network
> credentials).
>
>>I noticed strange sitiation.
>> When I try to connect with Windows Explorer to share folder on another
>> computer in net. I know that my account doesn't have the permissions so
>> the connection must to fail but instead I got the connection established
>> nevertheless although shouldn't be.
>> Now I go to see on sharing computer its share sessions and what I see:
>> the session with the name of user which is not mine(!) but of another
>> user on my computer.
>> Then I check into the security audit and found that there are the failed
>> attempts of network logon with my user name. It is right since I don't
>> have the permissions.
>> But then next it goes the succesfull logon(!) with different name of
>> local user from my computer.
>> It seems like if Windows Explorer browse user accounts onebyone and try
>> to fit them to connection until success.
>> Why it does that? I think it is wrong. Rather it should to show me the
>> failure to connect them ask me about new user name. Where I can read
>> about it more?
>> Thanks.
>>
>
>



Posted by Roger Abell [MVP] on February 16, 2006, 7:50 pm
Please log in for more thread options

> Thank you for your answer.
> You are right my asking systwm was Windows XP and excatly as you said in
> its credential cache there was the user/password which was used. When I
> deleted the credentials form cache the system began to ask them
> explicitly.
> The fact of matter was that that user account which I think the system
> used was same on my asking computer and on asked computer. So I thought
> that the system used the account from asking computer but really system
> just used cached account of this asked computer which happened to be
> equal. It created confusion for me.
>

Yes, that was (and can be) confusing

> But now I found another problem. If I successfully got connected to remote
> computer through net by Explorer then Explorer kinds of remember the
> successful credentials all times so that if I closes Explorer but later I
> start Explorer try to open connection to same computer it uses same user
> credentials again. Credential storage is empty since I didn't ask Windows
> to save it during first user/password authentication.
> I could break it by Windows restart. How to break it without restart? How
> to force Explorer to ask credential again on each connection?

When you connect over the network a connection object is formed.
This remains (for efficiencies) between uses of sessions over that
connection. There can be only one connection between two machines,
so only one set of credentials in use. When you reopen Explorer and
navigate to the folder you are firing up a new session on the connection.

Use net use to see connections that exist
Use net use <device> /delete to end a connection

> P>S. After first connection and then closing Explorer I see in "net use"
> the connection to asked computer but with status: "disconnected". Maybe
> Exploler just reuse this connection later?
>

yes, it does. connection formation is relatively high overhead so they
do not get flushed right away

>
>> Are you sure you are not reusing a preexisting connection to the server
>> that has the share ?? Does this happen on that machine after a fresh
>> logoff/login ? If so, run a cmd window and enter net use
>> Are there any persistent connections showing ?
>> If the machine from which you are doing this is XP, has there been any
>> credential caching for the account you are using ? This is in the Users
>> control panel applet for the account in use while in use (network
>> credentials).
>>
>>>I noticed strange sitiation.
>>> When I try to connect with Windows Explorer to share folder on another
>>> computer in net. I know that my account doesn't have the permissions so
>>> the connection must to fail but instead I got the connection established
>>> nevertheless although shouldn't be.
>>> Now I go to see on sharing computer its share sessions and what I see:
>>> the session with the name of user which is not mine(!) but of another
>>> user on my computer.
>>> Then I check into the security audit and found that there are the failed
>>> attempts of network logon with my user name. It is right since I don't
>>> have the permissions.
>>> But then next it goes the succesfull logon(!) with different name of
>>> local user from my computer.
>>> It seems like if Windows Explorer browse user accounts onebyone and try
>>> to fit them to connection until success.
>>> Why it does that? I think it is wrong. Rather it should to show me the
>>> failure to connect them ask me about new user name. Where I can read
>>> about it more?
>>> Thanks.
>>>
>>
>>
>
>



Similar ThreadsPosted
Seeing Null Share Connection in Eventviewer February 13, 2007, 4:27 am
Windows domain user is sometimes denied access to server share October 2, 2006, 5:07 am
Connection to a service under Windows 2003 November 4, 2006, 5:08 pm
Connection to a service under Windows 2003 enterprise October 19, 2006, 6:06 am
Folder/Share security question January 7, 2008, 10:17 am
Share folder and NTFS permission April 10, 2008, 6:47 pm
Utility to export file, folder, and share permissions July 10, 2006, 7:24 pm
Internet Explorer Enhanced Security Configuration April 7, 2006, 10:00 am
User Account Created - 624 And User Account Enabled - 626 for Hel October 13, 2005, 1:56 pm
Administrators account fails on "copy" using C$ share July 11, 2005, 7:17 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap