Windows – Why does Windows prompt for credentials when accessing the C$ share, but not when accessing a regular folder share

network-sharewindows

Scenario

  • I have two Windows 10 Pro computers A and B on the same domain.
  • I am logged on to Computer A using a domain account and I'd like to access share 'files' on computer B.
  • Before I start net use returns zero results and there's nothing in the Windows Credentials manager.

  • The sysadmin of Computer B has limited access to the 'files' share – only the local administrator (B\Administrator) has access.

  • Folder security on 'files' is: full control for users SYSTEM and
    B\Administrator, and members of the local B\Administrators group. The in-built Everyone group isn't listed.

  • I type \\b\files into the explorer address bar and I immediately get an error dialog: "Windows cannot access \\B\files. You do not have permission to access \\B\files. Contact your network administrator to request access.". Why don't I get prompted for credentials here once the authentication fails?

  • When I access \\b\C$, I get a prompt to "Enter Network credentials" with red text "Access is denied" at the bottom. Providing local administrator credentials works.
  • The audit log on B shows that when accessing both shares, the attempt is made using my domain account, but in the case of the C$ share it is subsequently giving me the opportunity to enter alternative credentials. Why doesn't this happen for the regular 'files' share? Is there something to do with how the sysadmin has configured permissions of the 'files' folder or share?

Work-around

  • I am aware I can use net use \\B\files * /user:B\username or map a
    drive using the Explorer GUI and supply alternative credentials.
  • I am aware I can cache credentials
    (using cmdkey)

While I'm aware of the workarounds, I'm trying to understand the difference in behaviour and whether I can get the 'files' network share to prompt after the automatically supplied credentials fail.

Best Answer

You're not getting prompted because the username "Administrator" on the two computer is the same.

If you have the scenario where a share \b\files has rights to "b\owner:f" and computer computer a you login as "owner" but the password on each is different when you type \b\files on computer a you will just get "access denied".

If you login on computer A as user "bob" and then type \b\files, you should get a prompt because you were not 'denied' yet. The user 'bob' does not exist with bob's password on computer b. Hence the request for a prompt.

In your scenario, computer b has the username "Administrator" so when you connect, the first thing it tries to do is send its own username and password. It failed, so you get "access denied" and no prompt.

Related Topic