RTC - Problem with permission on file server

Desdemona667

Hey you guys!
I've got a bit of a problem and I'm completely at my wits end.
A client of ours wants to be able to print his invoices as PDF. So far, so good. The trouble is: He wants to save them on his file server (using NAV, of course). While saving them to the server running the NAV-service (and SQL-server) is no problem at all, storing them on the file server is.
I, using the domain-admin account and logging in to NAV on the NAV server, have no problem saving PDF files directly from NAV to the file server, but the user I communicate with (working on his client machine [Win7, no NAV service]) has.
The error message he received was "The caller does not have the required permission or the specified path is read-only."
Originally the service-user was the domain-admin as well, but the user still got the error message. He himself also had all necessary rights to the folder in question and was able to create/delete/rename files manually.

The client company wanted the behaviour of the program to be changed, so that a new folder & sub folder would be created prior to PDF creation. I have done that using 'Microsoft Scripting Runtime'.FileSystemObject-automation. It works for me and it works for the user, as long as he tries to create new folders on the NAV server (error message "Error while calling member 'CreateFolder': Exception HRESULT: 0x800A0046 (CTL_E_PERMISSIONDENIED)" [roughly translated from german]).

It is obvious, that something must be amiss with permissions, but I really don't know, where to look. Searching this forum and the net hasn't helped yet. I have tried to tell our client's external hardware and domain administrator to check delegation properties, but since I really don't know anything about that type of thing (and maybe because I am female and he's lazy), not much has happened in that department, I think. They don't use kerberos authentication, if I understood that correctly.

It would really help, if someone could at least push me in the right direction, I've been at this problem for quite some time, without any result worth mentioning. Please feel free to ask, if I left any vital information to your imagination.

Some additional Info:
- File server is also Domain controler, Windows Server 2008 R2 Standard
- NAV 2009 R2, build 32012
- Server running NAV service & SQL server uses Windows Server 2008 R2 Standard as well
- The user experiencing the problem has super-role and is even dbowner on the database in question. I suppose, that all users will have the same trouble, because he is rather high up in the company and will probably have more rights than the average user.

Thanks in advance

Cheers,
-Marina

mik

Hi,
I am quite sure this can help you.
Keyword: Delegation
Please inform us if this is the solution for your problem.

http://blogs.msdn.com/b/nav/archive/2011/12/22/managing-network-files-in-rtc.aspx

/mik

Desdemona667

Hey!
Thank you! I stumbled across that same blog post a few minutes before I read your reply.
Since we don't have access to the domain admin anymore, I'll have to ask the customer's system engineer to look into this topic. I'll let you know if I get a response. ;D

Cheers,
-Marina

Edit:
The customer's IT-guy has done what the blog post suggested, but this doesn't seem to have helped. While we were able to save a pdf from NAV to the fileserver during testing (again: logged in as the service-user on the machine running SQL and the NAV-service), our customer still can't perform this task from his client PC.

Desdemona667

Well, Ive been told, that in addition to doing what that blog post suggested, you have to change some settings in the group policy editor (whatever it's real english name may be)... Something about Computer configuration --> Policies --> Windows settings --> Security settings --> Local policies --> User rights assignments. There the policy "Impersonate a client after authentication" would have to be set up. Several accounts should be added, that would otherwise only be authorised implicitly and additionally the NAV service user must be added as well.
Apart from this SPNs must be set up for SQL service, NAV service and NAV web service.

Our customer's IT guy has done all that (he said) and it still didn't change anything.
Since all of the above is beyond me, I'll just leave it at that.
Maybe one of my colleagues will have more luck solving this little problem, as I'm already in the middle of another project. I'll post a solution if ever we find one.

Cheers,
-Marina

Desdemona667

Allright, it seems to be working now... According to our client's other IT partner the NAV-config file needed to be changed. Apparently they just added/changed two lines to make it work.
DelegationInfo=DomainUser (new key)
and something about NTLM=false (which was true before).
I am so ashamed right now. :oops:

Edit:
This is about the ClientUserSettings.config
The exact values are:
<add key="DelegationInfo" value="DomainUser" /> (This one's new)
<add key="AllowNtlm" value="false" /> (previously set to "true")