Curious what site you're in?
Windows Domain DFS namespace – access is denied using domain FQDN, access allowed using server UNC paths directly
This was easily one of the most frustrating and ridiculous fun times I've had working with DFS.
The issue: At several client locations we run file server redundancy by offering (2) DFSR servers. A shared domain namespace with replicated folders to ensure they stay online if a server is offline for planned or unplanned good times. Within group-policy, we map folder redirection to a namespace path:
- "documents" -> "\\domain.com\users\username\documents"
- "desktop" -> "\\domain.com\users\username\desktop"
By referencing the namespace, it will redirect when server A or B is offline. This should NOT be used in WAN deployments, LAN is fast and therefore replication is fast. Initially the DFS issue was identified when drives mapped to the namespace were missing. Within the client event logs, we saw "access denied" errors associated with these drive-letters.
What we checked and verified:
- Problematic client stations could not connect to "\\domain.com\dfsroot" (access denied)
- Problematic client stations could not connect to "\\domain\dfsroot" (access denied)
- Problematic client stations could connect to "\\serverA\dfsroot"
- Problematic client stations could connect to "\\serverB\dfsroot"
- Permissions on the shares for the DFS Root folder were correctly set to "everyone" with read/write
- Each of these systems was removed and rejoined to the domain [no success]
- The local profiles were completely removed from the local systems (file system and registry) and logged back in [no success]
- Security suites were removed [no success]
- Each user was tested on working machines and had no issues obtaining the right drives
- When we disabled the 'offline files' component and rebooted -> "\\domain.com\dfsroot" was immediately accessible
The offline file cache was corrupt. When offline files are disabled, the system accesses the namespace location directly without issue. This confirms a reference to the namespace is clearly saved within offline file cache. If the cache is corrupt you end up with "Access is Denied". Another quick way to determine if the issue is corrupt cache is to simply try and access the DFS root UNC paths on each server. If you can browse the contents when bypassing the shared namespace path, and this user has no issues on other domain PCs, then it's not permissions.
Control Panel -> Sync Center -> Manage Offline Files -> Disable Offline Files
2) Clear the offline file cache
This sets a temporary registry entry which is read on start-up and runs the cache wipe.
Elevated Command Prompt -> "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Csc\Parameters /v FormatDatabase /t REG_DWORD /d 1 /f "
You must reboot to successfully wipe the offline file cache
4) Test the namespace path -> "\\domain.com\dfsroot"
If you can now browse the namespace contents, you can optionally re-enable Offline Files.
We understand the Offline Files component is critical to road warriors. You should be safe to re-enable it and reboot.
Control Panel -> Sync Center -> Manage Offline Files -> Enable Offline Files -> Reboot
After you log back in, check that you can still access the namespace path "\\domain.com\dfsroot" after you run a forced sync. If there are still issues, I recommend you follow the steps we initially took "What we checked and verified:" and repeat this fix.
There has been a lot of confusion on this topic, so let's clear it up!
If you intend on sharing your printer from a 32-bit server to 64-bit clients, you will need to ensure both 32 and 64-bit drivers are installed at the server. The issue however is that the server will not allow you to install 64-bit drivers. There is a really quick and simple solution.
1) Download the 32 and 64-bit Universal Printer Drivers from the manufacturer's site. DO NOT try and fiddle around with anything else.
2) Log into an as a domain administrator on a 64-bit PC or Server located in the same domain
3) From the command prompt run "printmanagement.msc"
---- Right Click "Print Servers" -> "Add/Remove Servers"
---- Enter the hostname of your server and click "Add to List"
---- Click "Apply" and "OK"
---- Expand the server you entered and load the "Drivers" child object
---- Right click the centre pane and choose "Add Driver"
---- Choose "x64" and "x86"
---- Complete the driver installation by assisting the installer to the INF files located in your 32 and 64-bit driver downloads you already completed
---- If you successfully installed the drivers, you should see both 32 and 64-bit listed under the drivers pane
4) It's now time to install and share the printer!
Browse to "Printer Management Console" -> "Printer Servers" -> "Server Name" -> "Printers" -> right click "Add Printer"
Complete the printer installation and select the drivers you installed when it asks.
5) Check the driver options
Select the printer you installed -> right click "properties" -> "Sharing" -> "Additional Drivers"
You should see both x64 and x86 drivers checked off; you're ready to roll!
If you do not see both checked off:
Select the printer you installed -> right click "properties" -> "advanced tab"
Choose the correct driver from the drop down list under "Driver: " and recheck the additional drivers options to verify.
We recently applied an upgrade from Worry Free Business Security 6.0 SP3 to 7.0. After the upgrade we noticed whitelisted Ephemeral and other port ranges in the firewall policies were not allowing traffic in. After numerous hours verifying everything was correctly setup we got in touch with Trend Micro and they sent back a patch to resolve the issue. We haven't seen this online yet, so I figure this may help a few of you.
Please apply the attached Hotfix to the WFBS Server. Unzip password: novirus
Let the agents update afterwards then observe if the issue persists.
We are looking forward to your reply.
Technical Support – Worry-Free Products and Services Trend Micro, Inc. “Securing Your Journey to the Cloud”
After applying this patch and allowing the update to propagate down to the clients, the port ranges started allowing traffic through.