[cifs-protocol] View effective Access - Parameter is incorrect

[Josh Curry]

Hi Andrew, thank you for your question. A member of the protocol documentation team will respond to you soon.

Josh Curry | Escalation Engineer | Open Specifications Support Team
P +1 469 775 2321
One Microsoft Way, 98052, Redmond, WA, USA http://support.microsoft.com


-----Original Message-----
From: Andrew Bartlett [mailto:abartlet at samba.org] 
Sent: Monday, March 2, 2015 10:00 PM
To: Interoperability Documentation Help
Cc: cifs-protocol at lists.samba.org
Subject: Re: View effective Access - Parameter is incorrect

On Tue, 2015-03-03 at 15:12 +1300, Andrew Bartlett wrote:
> Using a Windows 8, and a Windows 8.1 Pro machine, joined to a Samba 
> domain.
> 
> I open up \\$SERVER\sysvol and right-click on one of the files.  I 
> then select properties, security, advanced, effective access.
> 
> I select one of the other users in my domain (I logged in as 
> administrator), and then 'view effective access'.  The error I get is
> '0x80070057 the parameter is incorrect'.
> 
> I can't see anything odd, except that in frame 91-93 the client asks 
> for a TGS-REQ (S4U2Self) for a server of Administrator at REALM as an 
> enterprise principal, perhaps being denied because Administrator is 
> not a server account.
> 
> Samba master gives 'KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (see trace) Samba 
> 4.2 give 'KRB5KDC_ERR_POLICY' (not attached)
> 
> Is this the issue, if so, cue my discussion about MS-KILE 
> clarifications :-)

Oddly, when looking at a comparitive trace of Windows 8.1 to Windows 2012R2, I can't even see a S4U2Self request.  

Andrew Bartlett

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba