Ghost Solution Suite

 View Only
  • 1.  Cannot access file share in Windows 2003 Domain

    Posted Aug 16, 2006 06:45 PM
    We are currently using GSS.1.0. When we try to access a network share using a boot disk created with the boot disk wizard we get an Error 5: access denied. What are we doing wrong. The user name we are using has admin rights in the domain and has full control of the shared folder. we have tried a boot disk also made with GSS v1.1 and have the same problem. The domain is a 2003 AD domain.


  • 2.  RE: Cannot access file share in Windows 2003 Domain

    Posted Aug 17, 2006 04:32 AM
    When you say full control of the shared folder are you referring to share permissions or NTFS permissions or both? Have you tried forcing the permissions through by replacing permissions on child objects?


  • 3.  RE: Cannot access file share in Windows 2003 Domain

    Posted Aug 17, 2006 06:55 AM
    The LAN client software we license for the boot disks uses the NTLM authentication protocol. It may well be that the network you have has this protocol disabled (or the account you are using has the special NTLM password hash disabled). I would definitely check this possibility first, since Microsoft are moving to choosing high-security settings by default in newer servers.

    The reason the NTLM protocol is deprecated in current systems is that the design of the password hashing function it used was extremely poor, and could allow an attacker who can sniff network traffic to recover passwords with a little work. In modern switched networks the sniffing isn't quite so easy, but being careful about this is a good idea.

    So, what we recommend is this: for the Ghost boot disk you do have to enable the NTLM authentication protocol on the machine with the network share, but you can mitigate the risks of NTLM by ensuring that the account databases in your network don't store an NTLM hash (which means those accounts can't be used by the boot disk). Create a dedicated account which does have an NTLM hash just for the purpose of accessing the share with the images; if this account can only provide read-only access to your image repository, there is little risk even in the unlikely event it is compromised.


  • 4.  RE: Cannot access file share in Windows 2003 Domain

    Posted Nov 08, 2006 05:53 PM
    I'm trying another thing: one GSS1.2 Ghost Server with the console on SGHOST and one file server SIMAGE.
    I define tasks and resources to allow client initiation to deploy image locally. When I try to launch the task, The computer reboot then I have an error on Ghost Server SGHOST specifying that on Clone step:
    Task Reports error from GhostCast Server - The file \\SIMAGE\OS\XP_SP2_EN.gho could not be opened.
    Task Cancelled due to GhostCast Server

    Both servers are 2003 server, the Console service account has all rights (but I think this is not the reason).

    BUT if I launch the same task from the Ghost Console it WORKS!! why ?
    (maybe the reason could be that the Ghost Cast Server GhostSrv.Exe is launch under the account logged on)
    (I cannot see with which account GostSrv.exe is launched when I initiate the task from the client )

    And all works fine if the image is on SGHOST (locally from Ghost server), what is the normal design.


  • 5.  RE: Cannot access file share in Windows 2003 Domain

    Posted Nov 08, 2006 11:54 PM
    > maybe the reason could be that the Ghost Cast Server GhostSrv.Exe is launch under the account logged on

    Exactly right, although the inner machinery is a little more complex; when starting a task through the console, the Configuration Server service is passed a thing called the "user token" which is a handle that internally represents the logged-on user. While the task is executing the Configuration Server retains this, and when accessing files to transfer to the clients it temporarily assumes that identity.

    GhostSrv.exe gets a more special version of this treatment because of Terminal Server, so that the entire process is launched under a copy of that token (which ensures that the window it opens are directed to the same terminal services session as the one running the console).

    In the case of a client-initiated task, we don't do this impersonation and so the Configuration Server runs under the standard built-in account for services (the one displayed as SYSTEM in access control lists) and accesses files under that identity, which since that account has the "Act as Operating System" power means the task still works as long as the files are on a local disk, because SYSTEM implicitly has the power to read almost every file.

    Where this gets complex is for network file shares; in Windows NT, services running under the SYSTEM account were completely forbidden from performing any network access at all due to design oversights in the pre-Windows2000 domain systems. In Active Directory this design error was corrected, and services running under SYSTEM can access network resources because in Active Directory, the "special" user accounts that represent the machine itself can be added as a security principal in access control lists.

    So, if your console machine is install on a machine called CONSOLE which is a member of an Active Directory domain XYZ, the domain will contain a user account called CONSOLE$ which will be stored in the Computers container. Unlike NT4 domains, in Active Directory domains that account "XYZ\CONSOLE$" can be browsed for and added to access control lists. If the file server is also a member of the XYZ domain, you can add the console machine to the ACL for the specific share, and this will allow client-initiated tasks to work.

    If the file server isn't a member of the same domain, or if the Ghost console machine isn't in a domain, or if you're using an NT4 domain, then none of the special Active Directory design features apply and you're back to the NT4 situation where this doesn't work. So, you can either add the console machine account to the ACL list on the fileshare, or if you want local initiation you have to have the file actually stored on the console machine where the SYSTEM account has the implicit right to access it.

    > I cannot see with which account GostSrv.exe is launched when I initiate the task from the client

    It's SYSTEM, in this case. You can see this in action using the great Sysinternals Process Explorer tool from http://www.sysinternals.com/Utilities/ProcessExplorer.html

    If you use this tool, in the process display you add "User Name" and "Session" to the information displayed for tasks, and you'll see the account used for the NGSERVER.EXE service is "NT AUTHORITY\SYSTEM" aka S-1-5-18 and the "Session" (the Terminal Services session ID) is 0, and any GhostSrv.exe processes it launches from a client-initiated task will be the same.

    Any GhostSrv.exe processes it launches in response to a task started by the console will have the username and Terminal Server session ID as the one the user of the NGCONS.EXE process has when they launched the process. The same switching occurs internally to the NGSERVER process for various file accesses as well, it's just less visible.


  • 6.  RE: Cannot access file share in Windows 2003 Domain

    Posted Nov 09, 2006 04:37 AM
    You right one more time.It works as you explained
    I have my two server (File server and Ghost server) integrated in the same Active Directory, I have add my SGHOST sever account name to the share in read only on my file server and it works fine !!