Windows – how to test as local SYSTEM account? (accessing remote files from Python)

file-permissionsnetwork-sharepythonwindows

I'm trying to access some remote files from a web application server.
Let's call them servers M and R. Both are running Windows Server (2008 and 2003).

The remote files are on server R on a file share that is readable by Everyone (share permissions and security permissions allow Everyone to read). This share is called \\R\EthRelease.

The web application is on server M. I'm running a Python (really Jython) script under Tomcat servlet container (via BSF) in order to try to access the remote files on R.

But no matter what I do, the script cannot see the remote shared folder. E.g. I use Python code such as:

# Note, R: is a mapped network drive pointing to \\R\EthRelease
for file in ['C:', 'C:\\', 'C:\\Users', 'R:', 'R:\\',
        r"\\R\EthRelease", r"\\172.x.x.x\EthRelease"]:
    output.append("  <accessCheck dir='%s' exists='%s' accessF='%s' accessR='%s'/>\n" %
        (file, os.path.exists(file), os.access(file, os.F_OK),
        os.access(file, os.R_OK)))

and the only folders that the script says exist are C:\ and C:\Users:

<accessCheck dir="C:" exists="False" accessF="False" accessR="False"/>
<accessCheck dir="C:\" exists="True" accessF="True" accessR="True"/>
<accessCheck dir="C:\Users" exists="True" accessF="True" accessR="True"/>
<accessCheck dir="R:" exists="False" accessF="False" accessR="False"/>
<accessCheck dir="R:\" exists="False" accessF="False" accessR="False"/>
<accessCheck dir="\\R\EthRelease" exists="False" accessF="True" accessR="True"/>
<accessCheck dir="\\172.x.x.x\EthRelease" exists="False" accessF="False" accessR="False"/>

By contrast, when I do a dir on any of the above paths in the CMD prompt on server M, they exist and are readable:

C:\Users\me>dir r:\
 Volume in drive R is GIS
 Volume Serial Number is ...

 Directory of r:\

12/03/2012  09:18 AM    <DIR>          .
12/03/2012  09:18 AM    <DIR>          ..
07/25/2013  08:51 AM    <DIR>          EGI
12/17/2013  05:46 AM    <DIR>          maps
               0 File(s)              0 bytes
               4 Dir(s)  48,192,491,520 bytes free

C:\Users\me>

I have tried this with both Jython stable 2.5.3, and Jython beta 2.7b1, and got the same results.
I know it's not just a Python issue, because I run similar commands on my laptop (using Python 3.3) and am able to access the same network share successfully.

One possible difference is that the servlet container, Tomcat, is running as the local SYSTEM user on server M, while in the CMD shell I'm logged in as another user. But as mentioned before, Everyone has access to the remote file share, so that shouldn't make a difference, right? Is there some way I can log in as the SYSTEM user and test whether I'm able to access the remote file share in that state?

Another possible difference is that the servlet container or BSF might impose some sort of sandboxing restrictions, preventing me from accessing files outside of the servlet container. But that's not happening, because I'm able to check C:\.

Any ideas?? This has been driving me up the wall. I'd tried a couple of different times earlier to access the files directly from within Cocoon, and hit the same sort of wall. Recently I thought 'Eureka! I can outsource the problem to a Python script! Python can handle it!' But so far, no dice.

Best Answer

As discussed in these Super User questions – Elevated command line prompt can't access shared drives in Windows 7 and How to access network shares from an elevated process in Windows 7? – drive mappings are associated with a login, and so SYSTEM doesn’t have them unless you make special arrangements.  You may need to operate on the remote files by UNC or by doing a NET USE from your code.  Note that your test program reports that it has F and R access to \\R\EthRelease.