In Windows 8.1, how to force prompt for credentials when accessing a shared folder?

Question

I have a computer with Windows Server 2008 ("R1") SP2, which I use as a home server, and another with Windows 8.1 ("Home"), which I use daily. There is no domain controller in the network. I'm logged at Windows 8.1 with user A, let's call it PC\AUser. There is no user A at the server. I have a shared folder to the user B, let's call it SERVER\BUser.

How can I force to Windows 8.1 ask for credentials when I go to start -> run \SERVER\SharedFolder\ ?

For now I only receive this error: "You do not have permission to access \SERVER\SharedFolder. contact your network administrator to request access."

I've been able to share the folder unprotected, by adding "Everyone" to the permission list. But as soon as I remove "Everyone", the Windows 8 client simply says "you do not have permissions to access this folder", without asking for any credential.

I've already done it in the 2000 and XP days...

How to force the prompt for credentials in Windows 8.1?

Update:

I've accessed it from a Linux client with the command:

smbclient //SERVER/SharedFolder mypassword -U BUser

So this shifts the problem into the Windows 8.1 client - the server is configured OK.

Update 2:

On request, this is the error message I receive. It's in portuguese, but experienced users will recognize the window. It says "Title: Network Error. Windows couldn't access [folder]. You don't have permission to access [address]. Contact the network administrator to request access permission."

Update 3:

I have been able to connect to the share by using the "map network drive..." option and manually setting credentials there - but first I had to un-map the share using net use /delete because it seems Windows creates a stale mapping on the failed connection attempt (wtf?). This way, it is at least usable for me now. But will give the bounty reward if someone can solve or explain the issue of Windows 8.1 failing to connect with a permissions error instead of asking for credentials.

Final Update:

Found the solution! I've posted it as an answer.

Solution 1

Okay, Guys, I beat you all to it. :)

Fiddling with the server, I decided to check the "Sessions", under Shared Folders in Computer Management.

• Surprise, my Windows 8.1 computer was connecting with a Guest account!

• Then, I proceeded to disable the Guest account:

• Close the Guest session shown above

• Aaand... upon connecting to the share via Windows -> Run

Success!

Solution 2

The poster has found that after disabling the Guest account, Windows demanded a credential. I thought it important to add an explanation of this behavior (quoted from this source), that changed completely from after XP and starting with Vista.

Windows XP introduced a concept called Simple File Sharing that, when enabled, entirely eliminated security for file sharing. All network access was done in the context of the Guest user account, regardless of the remote user's actual account name. Essentially. anyone with physical access to your network could access any shared file. This made it much easier for other people in your home and office to get to each other's files.

Windows 8, 7, and Vista also include Simple File Sharing, although it's now called Password Protected Sharing. And, the effect of disabling and enabling the feature is reversed on the two newer operating systems.

This setting is not always changeable. In Windows XP Home Edition, Simple File Sharing is always checked and cannot be turned off. In all other versions of Windows, it can be turned on or off, except if the computer is a member of a domain network. In this case, passwords are always required.

Finally. Windows 8 and 7 have a new twist in the way that security works when Password Protected Sharing is turned off. On Vista and XP, when passwords are not required, all incoming network access uses the Guest account. Thus, anyone on the network can access any file in a shared folder if the file can be accessed by the user account Guest or by the user group Everyone.

But on Windows 8 and 7, the following happens when a remote user attempts to use a folder or file shared by a Windows 8 or 7 computer with Password Protected Sharing turned off:

• If the remote user's account matches an account in the Windows 8 or 7 sharing computer and that account has a password set, that account is used for file access
• If the remote user's account matches an account in the sharing computer but that account has no password set, then the Guest account is used.
• If the remote user's account matches no account in the sharing computer, the Guest account is used.

This might seem convoluted, but it is actually a very useful change. First of all, this change was necessary to support the new HomeGroup feature. All homegroup member computers use a special, password-protected account named HomeGroupUser$ to access other member computers, and this change lets it work whether Password Protected Sharing is turned on or off. Second, it gives you the option of giving designated users additional access privileges, without requiring you to set up a full-blown security scheme.

Solution 3

_{This was not the answer that worked for this post (see my other answer), but it might work for other people in different situations, so there is no point in down-voting.}

You may have already used some credential when connecting which doesn't have the necessary permissions, or that had them once and now doesn't any more. Windows will insist on using that useless credential for every connection, resulting in a really nice gotcha.

To make Windows forget that credential :

1. Go to Control Panel > User Accounts > Manage your credentials
2. Examine the list of credentials under Windows Credentials
3. Click on the down-arrow to the right of a credential for details
4. Click Remove from vault to delete.
5. In a Command Prompt that is Run as Administrator, enter net use * /DELETE.
   (This will delete the credentials for all network shares.)

Solution 4

Access to the share is user-based, not password-based.

The most simple way to achieve a basic protection for your share is to:

1. create a password-protected user account on your server,
2. assign to this user the necessary rights to the share (just as it was assigned to Everyone group),
3. make sure that same user also have necessary rights on filesystem-level (this are separate from share rights, yet both are required).

Afterwards, use the that user's login and password when accessing the share.

View more solutions

Comments

[NothingsImpossible]

I've assigned permission to the Administrator user on the server, but the client does not ask for any password; it simply fails with access denied. Do I need to create a non-Admin account for this?

[NothingsImpossible]

No deal. Created an user account, assigned filesystem AND share permissions to it. Windows 8 says I do not have permission. Of course I do not have permission - it didn't ask for any user and password!

[NothingsImpossible]

Re-worded the question completely. Take a look.

[Michał Sacharewicz]

Could you post an exact text or screen of error message?

[NothingsImpossible]

I've updated the question with the error screen on the question. Take alook.

[NothingsImpossible]

Tried removing all the credentials for the machine I am connecting to. No deal :(

[NothingsImpossible]

I saw you included item 5 with the net use command. Tried it, no result too. I managed to connect to the share by mapping it to a drive Letter; but using the Run dialog, it still gives the error

[harrymc]

Ah yes, I added above the last and missing step that could have saved you mapping the drive. I believe that my explanation above is correct: Windows caches useless credentials. The mapping trick you found apparently tricks it into asking again for the credential, but remembers it afterward. Windows is full of this kind of inconsistencies.

[Michał Sacharewicz]

Actually, per "Update 3" the previously mapped drive was the source of the problem. Windows systems have a security limitation that allows only one set of credentials being used on a target file server concurrently. In your case, your previous drive mapping was using the first set of credentials, and by subsequent mapping attempts you have tried to introduce the second set. Windows unfortunately responds to this situation with an unprecise error message that is similar to the "insufficient rights" message. Had that problem couple of times, removing all mapped drives and relogging solves it.

[NothingsImpossible]

I've already removed all previously mapped drives, removed all the credentials, rebooted the machine. Still, when accessing the folder via The Run Dialog, it doesn't ask for credentials. Mapping the shared folder is the only way to connect with custom credentials. I am starting to think this is a "feature" of Windows 8.

[harrymc]

Did you use net use * /DELETE or net use {share-name} /DELETE?

[NothingsImpossible]

Both of them...

[harrymc]

Your computer is being difficult. An old remedy that might still work was to set the registry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa the value of DisableDomainCreds (REG_DWORD) to 1, reboot, reset it to 0, reboot again.

[NothingsImpossible]

Couldn't follow the article's instructions because my edition is "Home" (not Pro, neither Enterprise) so there is no Group Policy snap-in. Besides, the article talks about automatically reconnecting mapped drives on log-on, not quite what I am asking for... I've tried your registry hack, but it didn't solve the issue. When accessing the folder via The Run Dialog (Windows > run), it doesn't ask for credentials. Mapping the shared folder is the only way to connect with custom credentials. I am starting to think this is a "feature" of Windows 8.

[NothingsImpossible]

Finally found a solution! I posted it as answer. Thanks for the help!

[NothingsImpossible]

Finally found a solution! I posted it as answer. Thanks for the help!

[harrymc]

I have added another answer that explains this behavior, for future readers.

[NothingsImpossible]

Password protected sharing is disabled on my server now because if I enable it, I get other error message when trying to access the share, worth of another superuser question... Does that mean that all my shares are exposed to anyone or only those that I explicitly give permissions to "Everyone"?

[NothingsImpossible]

Nevermind, password protected sharing is enabled on my server, please ignore my previous comment. When it is disabled that I get nasty errors, but probably because there is no matching account there AND Guest is disabled. Thanks for the thorough explanation, it is worth a reward ;) You dug a book reference, it seems this is a peculiar issue I stepped on.

[harrymc]

This problem is particularly difficult to analyze for persons having experience with XP, since Microsoft went and changed everything in Windows Vista. I also learned from your experience.