[Samba] Windows permissions

Dave Close dave at compata.com
Tue Nov 5 01:42:50 UTC 2024


I wrote:

>I think I'm fairly good with Linux (since 1991) but mostly clueless
>with Windows. When I need Windows help, the Web has been my savior.
>But not this time...
>
>I have three Windows 10 boxes which I can successfully access
>using xfreerdp so I presume I know the available users and
>passwords. However, trying to access with winexe is proving difficult.
>
>1. The command, <winexe -U winuser ...>, immediately prompts me for
>"dave's" (my) password. I don't have an account under my own name on
>the Windows boxes and winuser != dave. I think I resolved this using
>smbpasswd to create an SMB user for myself on Linux. It seems that I
>also needed to create an SMB user for winuser on Linux. But although
>I gave SMB winuser his correct Windows password, winexe doesn't seem
>to use it, prompting me for the password. (All three boxes have the
>same user, winuser, with the same password.)
>
>2. For two of the Windows boxes, the command < winexe -d 2
>-U winuser%password //address "systeminfo" > returns the error,
>
>  winexe_svc_install: dcerpc_svcctl_CreateServiceW failed: WERR_ACCESS_DENIED
>  main: winexe_svc_install failed: NT_STATUS_ACCESS_DENIED
>
>However, for the third box, the same command returns the error,
>
>  main: cli_full_connection_creds failed: NT_STATUS_IO_TIMEOUT
>
>("address" is, of course, different for each of the commands.) I have
>no trouble running the systeminfo command in a cmd shell on the three
>boxes when connected with RDP. I'm using systeminfo here as a simple
>command just to prove that I can get something to work.
>
>I presume these errors are caused by some improperly set configuration
>on the Windows boxes but I have no idea what to change to fix them.
>All winexe examples I seen seem to presume that connections will work
>and don't say what to do when they don't. Please help me.

After lots of searching and multiple failed tries, my problem was resolved with a policy change on 
the Windows boxes. The solution came from the last idea (currently) in 
<https://superuser.com/questions/1013702/completely-disable-uac-in-windows-10>:

  Use gpedit.msc to access and disable the entry,
    Computer Configuration
    -> Windows Settings
    -> Security Settings
    -> Local Policies
    -> Security Options
    -> User Account Control
    Run all administrators in Admin Approval Mode
-- 
Dave Close, Compata, Irvine CA      "You can only be young once
dave at compata.com, +1 714 434 7359    but you can be immature forever."
dhclose at alumni.caltech.edu             -- Dave Barry





More information about the samba mailing list