How to Create SMB Share as Non-Admin on Windows Server 2016

network-sharewindows-server-2016

Windows Server 2016, Octopus Deploy.

Is it possible to create network shares as a non-admin?

I'm trying to run an automated deployment under a non-admin account. The last step of the deployment is to create a network share so that end-users are able to access some of the deployed files.

But New-SmbShare -Name $shareName -Path $path -ReadAcces $domainusergroup fails with a Permission Denied (5). The script works when the deployment account is added to Administrators group, but that's what I'm trying to avoid.

The deployment account has Full Control on the deployed folder (and specifically the folder I'm attempting to share).

Creating the share as an admin beforehand is not an option.

Predictably, googling the issue produces tons of resources for configuring permissions to access network shares, but none discuss the permissions required to actually create a share.

Best Answer

Administrative rights are needed to create new shares.

It is not supported to delegate this permission; however it may be possible by heavily modifying the registry, but I would not recommend that.

Related Solutions

Windows xp cannot access admin share

As their name suggests, admin shares can be accessed only by users that are administrators on that computer.

You need to create the same user in every computer, and that user must be administrator in all of them. It should have a password, because in some occasions users without passwords won't work.

Note use that you if you renamed a user this won't work, since renamed users maintain their original network name.

Samba Share – Granting Samba Share Permission to AD Computer Accounts

Unfortunately permissions to a share cannot be granted to a computer account; only users. Yes, it looks like you should be able to do that, and the OS allows you to make the entry, but it doesn't actually work like you'd expect.

One way to get around this is, for instance if you're running a script as a scheduled task, is to mount network drive as a specific user who has access to that share, like so:

net use * \\server\share /user:DOMAIN\username

this will use the first-available drive letter (starting at Z: and going backward from XP/2003 on, but starting at the beginning in Win2k).

You can also specify a drive letter as long as it's not in use:

net use u: \\server\share /user:DOMAIN\username

When complete, don't forget to unmount the share with:

net use u: /d

(Note that you can of course test for the presense of the drive's use, or just drop the mount before mounting it, but I leave that to you.)

Best Answer

Related Solutions

Windows xp cannot access admin share

Samba Share – Granting Samba Share Permission to AD Computer Accounts

Related Topic