Marka la gelayo adeegga isticmaala saamiyada shabakadda ee serfarka heerka dhexe, isticmaalayaashu waxa lagu soo jeediyaa aqoonsi, oo aakhirka waxay la kulmaan khalad gelitaanka loo diiday. Maqaalka maanta, waxaan ku soo bandhigi doonaa dhowr xaaladood oo kiis, oo aan aqoonsano sababta ka dibna aan bixino xalinta suurtagalka ah ee arrinta sababta wafdiga xaddidan ee CIFS ay ugu guuldareysteen ACCESS_DENIED qalad gudaha Windows 10.

Nidaamka Faylka Intarneed ee Caadiga ah (CIFS)^{(Common Internet File System (CIFS))} waa hab-maamuuska faylalka-wadaaga kaasoo bixiya hannaan furan oo iskutallaab ah oo lagu codsanayo faylalka iyo adeegyada server-ka shabakadda. CIFS  waxay ku salaysan tahay nooca la xoojiyey ee borotokoolka Barta Fariimaha Server-ka ee Microsoft (SMB) ee wadaaga faylalka Internetka^(Internet) iyo intranetka.

Waftiga xaddidan ee CIFS ayaa ku guul-darraystay Windows

Waxaa laga yaabaa inaad la kulanto arrintan haddii isticmaalaha lagu soo jeediyo aqoonsiga, iyo gelitaanka ugu dambayntii ku guuldareysto iyadoo gelitaanka loo diiday qalad ku salaysan saddexda xaaladood ee soo socda.

Dhacdada 1^{(Scenario 1)}

• Shabakadda IIS waxa lagu dejiyay hagaha guriga oo tilmaamaya saamiga fog iyadoo la adeegsanayo xaqiijinta laga gudbayo iyo ergada xaddidan ee loo habeeyey CIFS .
• Barkadda codsiga IIS ee gelaysa saamigaas waxay ku hoos socotaa aqoonsiga koontada adeegga.
• Koontada bogga waxaa lagu aaminay ergada adeegga CIFS ee seerfarka faylka.

Dhacdada 2^{(Scenario 2)}

• App-ka shabakada waxa uu isku dayayaa in uu galo server-ka faylka isticmaale ahaan.
• Barkadda codsiga IIS ee gasho saamigaas waxay ku hoos socotaa aqoonsiga koontada adeegga. Koontada bogga waxaa lagu aaminay ergada adeegga CIFS ee seerfarka faylka.
• Waftiga xaddidan ee loo habeeyey CIFS waxa lagu habeeyey koontada adeegga ee serfarka faylka.

Dhacdada 3^{(Scenario 3)}

• Codsi kasta oo dhinaca server ka ah oo laga helayo macmiilku wuxuu gelayaa saamiyo fogfog isticmaale ahaan.
• Codsiga-dhinaca server-ka wuxuu ku socdaa macnaha guud ee akoontada adeegga.
• Koontada Adeegga^(Service) waxaa lagu aaminay ergada waxaana loo habeeyey wafdiga CIFS ee seerfarka faylka.

Tan waxaa loo aqoonsaday inay tahay dhibaato u dhaxaysa MrxSmb 2.0 iyo Kerberos marka wafdi xaddidan ay ku lug leeyihiin.

Si arrintan loo xalliyo, Microsoft waxay bixisaa laba hab-raac.

Hawsha 1

Isticmaal koontada mashiinka halkii aad ka isticmaali lahayd koontada adeegga aqoonsi ahaan codsiyada fulin doona ergada xaddidan ee CIFS . Habee ergada xaddidan marka heerka shaqo ee domainku yahay Windows Server 2003 , Windows Server 2008 , ama Windows Server 2008 R2.

Si aad tan ugu samayso barta kontorooliyaha ee domainka server-kaaga, samee waxa soo socda:

• Guji Start > Administrative Tools > Isticmaalayaasha Hagaha Firfircoon iyo Kombiyuutarrada^{(Active Directory Users and Computers)} .
• Balaadhi^(Expand) domainka, ka dibna balaadhi galka Kombiyuutarada^(Computers) .
• Shaxda saxda ah, midig-guji magaca kumbuyuutarka ee webserver-ka, dooro Properties , ka dibna riix   tabka Ergada .^(Delegation)
• Dooro  Kalsoonida kombayutarkan ergada adeegyada la cayimay oo keliya^{(Trust this computer for delegation to specified services only)} sanduuqa hubinta.
• Hubi in  Isticmaalka Kerberos kaliya^{(Use Kerberos only)}  la doortay, ka dibna dhagsii  OK .
• Riix  badhanka ku dar^{(Add button)} .
• Ku  dar sanduuqa wada hadalka ^(Add) Adeegyada^(Services)  , dhagsii  Isticmaalayaasha ama Kombiyuutarada^{(Users or Computers)} , ka dibna ka baadho ama geli magaca server-ka faylka kaas oo ka heli doona aqoonsiga isticmaalaha IIS .
• Guji  OK _
• Liiska  Adeegyada ^(Services)La heli karo^(Available)  , dooro  adeegga CIFS .
• Guji  OK _

Hawsha 2

Hawshan laguma talinayo^{(not recommended)} sababtoo ah waxay u baahan tahay  Isticmaal^(Use) ergada borotokoolka xaqiijinta ee akoontada kombiyuutarka. Haddii la  isticmaalo mid ka mid ah ikhtiyaarka borotokoolka xaqiijinta^{(Use any authentication protocol)}  , akoonku wuxuu isticmaalayaa ergada xaddidan oo leh nidaamka kala-guurka.

Haddii ay tahay inaad u isticmaasho aqoonsiga codsiyada sida akoon adeeg iyo/ama akoon domain, ka dib samee waxyaabaha soo socda:

Tallaabada 1^{(Step 1)}

• Guji Start >  Administrative Tools > Isticmaalayaasha Hagaha Firfircoon iyo Kombiyuutarrada^{(Active Directory Users and Computers)} .
• Balaadhi^(Expand) domainka, ka dibna balaadhi galka Kombiyuutarada^(Computers) .
• Shaxda saxda ah, midig-guji magaca kumbuyuutarka ee webserver-ka, dooro Properties , ka dibna riix   tabka Ergada .^(Delegation)
• Dooro  Kalsoonida kombayutarkan ergada adeegyada la cayimay oo^{(Trust this computer for delegation to specified services)} keliya sanduuqa hubinta.
• Hubi in la  isticmaalo borotokool kasta oo xaqiijin ah^{(Use any authentication protocol)} .
• Guji OK _
• Riix  badhanka ku dar^{(Add button)} .
• Ku  dar sanduuqa wada hadalka ^(Add) Adeegyada^(Services)  , dhagsii  Isticmaalayaasha ama Kombiyuutarada^{(Users or Computers)} , ka dibna ka baadho ama geli magaca server-ka faylka kaas oo ka heli doona aqoonsiga isticmaalaha IIS .
• Guji  OK _
• Liiska  Adeegyada ^(Services)La heli karo^(Available)  , dooro adeegga CIFS^{(CIFS service)} .
• Guji  OK _

Tallaabada 2^{(Step 2)}

• Shaxda bidix, balaadhi galka Isticmaalayaasha.
• Shaxda saxda ah, ku dhufo midigta akoontiga adeegga kaas oo ah aqoonsiga barkada codsiga, dooro  Properties , ka dibna dhagsii   tabka Ergada .^(Delegation)
• Dooro  Kalsoonida kombayutarkan ergada adeegyada la cayimay oo keliya^{(Trust this computer for delegation to specified services only)} sanduuqa hubinta.
• Hubi in  Isticmaalka Kerberos kaliya^{(Use Kerberos only)} la doortay.
• Guji OK _
• Riix  badhanka ku dar^{(Add button)} .
• Ku dar sanduuqa wada hadalka ^(Add) Adeegyada^(Services)  , dhagsii  Isticmaalayaasha ama Kombiyuutarada^{(Users or Computers)} , ka dibna ka baadho ama geli magaca server-ka faylka kaas oo ka heli doona aqoonsiga isticmaalaha IIS .
• Guji  OK _
• Liiska  Adeegyada ^(Services)La heli karo^(Available)  , dooro adeegga CIFS^{(CIFS service)} .
• Guji  OK _

Waxaan rajeynayaa in qoraalkani uu ku caawinayo.^{(Hope this post helps.)}

ACCESS DENIED - Constrained delegation for CIFS fails

While accessing a sеrvice that uses netwоrk shares on a middle-tier serνer, users are prompted for credentials, and they eventually encounter an access denied error. In today’ѕ post, we will presеnt a couple of case scenarios, identify the causе аnd then provide the possіble workarounds to the issυe of why constrаined delegation for CIFS fаils with ACCESS_DENIED error in Windows 10.

Common Internet File System (CIFS) is a file-sharing protocol that provides an open and cross-platform mechanism for requesting network server files and services. CIFS is based on the enhanced version of Microsoft’s Server Message Block (SMB) protocol for Internet and intranet file sharing.

Constrained delegation for CIFS fails in Windows

You may encounter this issue if the user is prompted for credentials, and access eventually fails with an access denied error based on the following three scenarios.

Scenario 1

• The IIS website is set up with the home directory pointing to the remote share using pass-through authentication and constrained delegation configured for CIFS.
• The IIS application pool accessing that share is running under the identity of the service account.
• The domain account is trusted for delegation for the CIFS service on the file server.

Scenario 2

• The web app is trying to access a file server as a user.
• The IIS application pool that accesses that share is running under the identity of the service account. The domain account is trusted for delegation for the CIFS service on the file server.
• Constrained delegation configured for CIFS is configured on the service account for the file server.

Scenario 3

• Any server-side application that’s being accessed from a client is accessing remote shares as a user.
• The server-side application is running under the context of a service account.
• The Service account is trusted for delegation and configured for CIFS delegation for the file server.

This has been identified as a problem between MrxSmb 2.0 and Kerberos when constrained delegation is involved.

To resolve this issue, Microsoft offers two workarounds.

Workaround 1

Use a machine account instead of a service account as the identity for applications that will be performing constrained delegation for CIFS. Configure constrained delegation when the domain functional level is Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2.

To do this on the domain controller for your web servers domain, do the following:

• Click Start > Administrative Tools > Active Directory Users and Computers.
• Expand domain, and then expand the Computers folder.
• In the right pane, right-click the computer name for the webserver, select Properties, and then click the Delegation tab.
• Select the Trust this computer for delegation to specified services only checkbox.
• Make sure that Use Kerberos only is selected, and then click OK.
• Click the Add button.
• In the Add Services dialog box, click Users or Computers, and then browse to or enter the name of the file server that will receive the user’s credentials from IIS.
• Click OK.
• In the Available Services list, select the CIFS service.
• Click OK.

Workaround 2

This workaround is not recommended because it requires Use any authentication protocol delegation on the computer account. If the Use any authentication protocol option is selected, the account is using constrained delegation with protocol transition.

If you must use the identity of applications as a service account and/or domain account, then do the following:

Step 1

• Click Start > Administrative Tools > Active Directory Users and Computers.
• Expand domain, and then expand the Computers folder.
• In the right pane, right-click the computer name for the webserver, select Properties, and then click the Delegation tab.
• Select the Trust this computer for delegation to specified services only checkbox.
• Make sure that Use any authentication protocol is selected.
• Click OK.
• Click the Add button.
• In the Add Services dialog box, click Users or Computers, and then browse to or enter the name of the file server that will receive the user’s credentials from IIS.
• Click OK.
• In the Available Services list, select the CIFS service.
• Click OK.

Step 2

• In the left pane, expand the Users folder.
• In the right pane, right-click the service account that’s the identity of the application pool, select Properties, and then click the Delegation tab.
• Select the Trust this computer for delegation to specified services only checkbox.
• Make sure that Use Kerberos only is selected.
• Click OK.
• Click the Add button.
• In the Add Services dialog box, click Users or Computers, and then browse to or enter the name of the file server that will receive the user’s credentials from IIS.
• Click OK.
• In the Available Services list, select the CIFS service.
• Click OK.

Hope this post helps.

Related posts

• Fix Error 1005 Gelitaanka Fariinta La Diiday markaad booqanayso mareegaha

• Adeegga Macmiilka ee DHCP waxa uu ku siinayaa cilad Helitaanka la diiday Windows 11/10

• Sida loo habeeyo fariinta khaladka ah ee Helitaanka la diiday ee Windows 10

• Gelitaanka waa la diiday, ma haysatid ogolaansho aad ku gasho serfarkan

• Hagaaji Gelitaanka Kontroolka Helitaanka waa qalad kharriban gudaha Windows 10

• Hagaaji ShellExecuteEx wuu fashilmay; qaladka code 8235 ee Windows10

• Kumbuyuutarkan looma cusboonaysiin karo Windows 10 sababtoo ah Goobaha Kaydinta Lammaaniga ah

• Dejintu way awoodi wayday inay ku abuurto khalad qaybta qaybta cusub ee Windows 10

• Habkani waxa uu u baahan yahay warbaahin meesha laga saari karo - Qaladka dib u dejinta erayga sirta ah

• Sida loo hagaajiyo gelitaanka waa la diiday, waxaa laga yaabaa in faylka la isticmaalo, ama la wadaago khaladaadka xadgudubka ee Windows

• Hagaaji ShellExecuteEx qalad ku fashilmay Windows 11/10

• Hagaaji Bdeunlock.exe Sawirka Xun, Khaladka Nidaamka ama Aan ka jawaabin khaladaadka

• Sida loo hagaajiyo gelitaanka waa la diiday Windows 10

• Sida loo hagaajiyo gelitaanka uTorrent waa la diiday (ku qor saxanka)

• Madax adag ayaa heshay fariin khaldan oo xog xun Windows 10

• Aan awoodin inuu dejiyo Mulkiilaha cusub OS, Helitaanka waa la diiday Windows 10

• Hagaajin waa ku guuldareystay in lagu shubo qaladka steamui.dll Windows 11/10

• Hagaaji Gelitaanka Rakibaadaha Daaqadaha Windows

• Sida Loo Hagaajiyo Gelitaanka Google Drive Cilad La Diiday

• CALINTA SHABAKADDA LA DIIDAY | CALINTA INTERNETKA OO LA JIRA