All,
Working through an odd issue I've bumped up against regarding Office 2016 (probably other versions) and saving to remote shares.
Scenario is as follows:
Two domains, no trust between. User A is on Domain A, User B on Domain B. File servers are available on both Domain A and B.
User on Domain B has an account on Domain A, and can connect remotely to share on File Server A just fine. User can create .txt files, docx files, etc without issue (with Right click -> new file). Permissions are irrelevant (set full control
to Everyone, direct to user account, etc). User can edit, save, delete .txt files without issue. Freshly created .docx file inherits permissions as expected, and file can be renamed without issue. If user B's 'Domain A account' edits that
.docx file however, and saves it, the permissions on the file get blasted, and the NTFS owner becomes unresolvable. At that point any further attempts to open the file from any source gets access denied. I can re-take ownership with admin credentials/elevated
token, at which point the security tab shows no permissions assigned. I can re-add permissions (or reassign inheritance) and open the file, and see the data that the user added. This tells me the file is being edited, then permissions changed somehow.
This does not happen if User A connects to File Server B with 'Domain B credentials' and write/save files. Everything there appears to work fine. Both domain file servers are 08R2, both domain workstations are using Office 2016, fully patched. Tested
with different workstations, different 'Domain A accounts', different Domain B users, etc. Tested with different shares, subfolders, different permission assignments, etc. Same result, Office alters the Owner/NTFS perms of file after writing data. User can create document on local machine on Domain B, then copy the file into File Server A's share, and file is fine... openable, correct permissions, etc. If user edits that file again however, same result. Perms wiped, owner unresolvable.
It looks very very similar to a few issues with past versions of office, as seen here:
https://www.experts-exchange.com/questions/28094803/Microsoft-Office-Access-Denied-Contact-Your-administrator-message-when-saving-to-Network-Drive.html
The above was fixed by a user changing an option on a 3rd party device to prevent the editing of NTFS permissions on files, essentially blocking whatever functionality was causing this.
Other is here:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/bae1e32a-b878-4af2-8d27-9b747e11bf21/kb980232-ms10020-problem-users-cant-save-anymore-from-office-2007-applications-to-servers?forum=winservergen
Vaguely related, seems to have something to do with patch incompatibility with very old SMB (1.0) shares. I doubt the cause is the same (most of the information in that technet post is irrelevant at this time) but the symptoms are similar.
Thank you.
EDIT: Forgot to include, symptoms are identical whether or not user's office is signed in or not, and persists through restarts.
Additional EDIT: Symptoms appear to only affect DFS shares. If saved to some_server\share, permissions behave as expected. If saved to DOMAIN\Share, permissions go sideways upon saving. If saved to some_server\DFS_SHARE, same thing
happens. DFS for said share is currently set to a single namespace server (so only a single server is being touched), DFS share permissions permit full control to Everyone, and DFS is accessible normally from other domain IP space.
