• Home
  • About 404TS
  • Contact

404 Tech Support

Where IT Help is Found

  • Articles
    • Code
    • Entertainment
    • Going Green
    • Hardware, Gadgets, and Products
    • Management
    • Network
    • News
    • Operating Systems
    • Security and Privacy
    • Software
    • System Administration
    • Talking Points
    • Tech Solutions
    • Web
    • Webmaster
  • Reviews
  • Media
    • Infographics
    • Videos
  • Tech Events
  • Tools
    • How do I find my IP address?
    • Browser and plugin tests
  • Get a Technical Consultation
You are here: Home / Articles / System Administration / Access-based enumeration for DFS folder targets

Access-based enumeration for DFS folder targets

2016-11-28 by Jason

Moving to a Distributed File System required testing for a few parity features. One of those was Access-Based Enumeration. This simplifies an end-user’s navigation experience because they only see the folders that they have access to. This was in place in our current file servers and would be a tough sell without the feature.

Access-based enumeration is easy to turn on for your namespace but configuring it requires a little more attention to detail. Right-click on your namespace and go to Properties. Under the Advanced tab, there is a simple checkbox to ‘Enable access-based enumeration for this namespace’.

dfs_abe

Looking at the folder target properties, it also has an Advanced tab to specify view permissions of the folder. The default option is to ‘Use inherited permissions from the local file system’. I was hoping for the interpretation that it would pull the permissions from the target of the folder but I was not so lucky. It uses the local permissions of the DFS Namespace server with the DFSRoot folder. This meant by default, members of Domain Users were able to see all folder targets, even if it pointed to a server where they did not have access or the target server had access-based enumeration turned on. Instead, I would need to use the ‘Set explicit view permissions on the DFS folder’.

dfs_explicitview

Wanting to script the creation of the folder targets, I found the PowerShell cmdlet Grant-DfsnAccess and thought it would do exactly what I needed. Unfortunately, it seems to have a bug that does not work for access-based enumeration. The problem is described in KB2938148:

Although the Grant-DfsnAccess cmdlet successfully configures the view permissions for individual groups or users, the cmdlet does not change the inheritance mode from use inherited to set explicit. Therefore, the permissions that are set on the link do not take effect.

There are two methods suggested to work around the problem.

Method 1

Manually disable inheritance in the DFS Management Console by selecting the Set explicit view permissions option.

Method 2

Use the dfsutil property sd grant command instead.

The problem was such that using the Grant-DfsnAccess cmdlet would revert the setting back to ‘Use inherited permissions from the local file system’. So even if you manually fixed the issue before and ran the cmdlet again, you would have to manually fix it again.

The explicit permission is a simple Allow or Deny read-access, so it’s not complex but needing to set it for each person or group that needs access to your DFS folder target would be tedious and should be scripted away to reduce errors and inconsistency. I used the dfsutil command line method in my PowerShell script and it worked perfectly fine.

The following line would allow user SarahConnors to Read the folder target while others would not see the folder target as an option.

dfsutil property sd grant \\404techsupport.com\Projects\IT 404TS\SarahConnors:RX protect

dfs_perms

Of course, you still need to set your permissions properly on the target server for proper security.

Filed Under: System Administration Tagged With: dfs, windows server

Trending

  • Logitech introduces two new Orion Cherry mechanical keyboards
    In Hardware, Gadgets, and Products
  • Resource conflict thanks to ATI PCI Express 3GIO Filter Driver
    In Tech Solutions
  • A Week of Google Code, Day 1: touchfreeze
    In Software, Tech Solutions

Latest Media Posts

Find Out Where To Download SNES ROMs

Find Out Where To Download SNES ROMs

Multifunctional Video Conversion Tools – Wondershare Video Converter

Multifunctional Video Conversion Tools – Wondershare Video Converter

  • Popular
  • Latest
  • Today Week Month All
  • How to ‘Unblock’ multiple files at a time with PowerShell How to 'Unblock' multiple files at a time with PowerShell
  • Increase IIS Private Memory Limit to improve WSUS availability Increase IIS Private Memory Limit to improve WSUS availability
  • SOLVED: “This modification is not allowed because the selection is locked.” SOLVED: "This modification is not allowed because the selection is locked."
  • Configure Outlook to recurring appointments for the last weekday of the month Configure Outlook to recurring appointments for the last weekday of the month
  • Creating and editing views in phpMyAdmin Creating and editing views in phpMyAdmin
  • 3d rendering circuit cloud for cloud computing technology Build and Deploy a Modern Web 3.0 Blockchain App in 2022
  • Telecom Application Development: When to Outsource Telecom Application Development: When to Outsource
  • Printer printing document wirelessly from mobile phone or smartphone wifi connection vector flat cartoon illustration, file air print on fax or ink jet via cellphone bluetooth modern design Why Your Business Needs Online Fax Services In 2022
  • 6 Best Ways to Protect Your Business Account 6 Best Ways to Protect Your Business Account
  • How to download videos from Instagram How to download videos from Instagram
Ajax spinner

Elevator Pitch

404 Tech Support documents solutions to IT problems, shares worthwhile software and websites, and reviews hardware, consumer electronics, and technology-related books.

Subscribe to 404TS articles by email.

Recent Posts

  • Build and Deploy a Modern Web 3.0 Blockchain App in 2022
  • Telecom Application Development: When to Outsource
  • Why Your Business Needs Online Fax Services In 2022

Search

FTC Disclaimer

404TechSupport is an Amazon.com affiliate; when you click on an Amazon link from 404TS, the site gets a cut of the proceeds from whatever you buy. This site also uses Skimlinks for smart monetization of other affiliate links.
Use of this site requires displaying and viewing ads as they are presented.

Copyright © 2022 · Magazine Pro Theme on Genesis Framework · WordPress · Log in