Access is denied to a network folder/Drive

Question

How to deal with error "Access is denied to a network folder"?

Answer 1

The answer to this question depends on (a) whether or not the CompleteFTP service is running under a domain account and (b) whether the network folder is on a machine that's on the domain. Therefore this answer is in three parts:

Part A: When a domain user tries to access a network folder, if it fails and an error is seen in the log like below:

Access to the path '\\abc.xyz\path' is denied

To resolve:

1. Check that this user has access to this folder from outside of CompleteFTP.
2. If so, check the log for "Interactive Windows logon failed for user domain\USERNAME (LogonUser). Trying Network logon."

If interactive logon is failing, the user does not have the correct permissions for an interactive logon. The user may need the "Allow log on locally" permission added. This is not usually a problem, since by default all users are granted this permission - except on domain controllers. On domain controllers, the right to 'Allow log on locally' is granted by default only to administrators.

Part B: If a non-Windows user is being denied access to a network folder, the scenario is slightly different. CompleteFTP runs under the LocalSystem account, and so non-Windows users also run as LocalSystem (although they are restricted to their configured directories). So if access is denied, LocalSystem needs to be given access to the network folder.

When accessing the network, the LocalSystem account acts as the computer on the network. In a domain environment, you can grant access rights to computer accounts. So, if you have a computer called DESCARTES, you'll have an Active Directory computer account called DESCARTES$, which you can grant permissions to.  For multiple domains this only works if the domains are in a trust relationship. 

Part C: If the machines are not in a domain, then it's more difficult. You'll need to create a user with similar permissions to the System user to run the service under. You could then create an identical account with the same credentials on the other machines so it can access those machines shared drives.