The network protocols net use is using and the way how it is failing corresponds to what we are seeing when taking network traces of the application. From the software manufacturer we got a simple test case where a net user %USERNAME% /domain is failing with an Error 5 - Access is denied in this infrastructure.
In this constellation, an application's client (based on the UniPaas Framework if this matters) is trying to read a specific user's group memberships and fails for an unknown reason. Most notably, the Everyone:Read permission has been removed from the list for most directory objects so users are unable to read "foreign" objects to comply with a privacy protection policy. I do have a domain where the default ACLs have been altered on all user and computer objects and the List Object Mode (Access Based Enumeration for directory objects) has been enabled.
0 kommentar(er)
