DFS shares not accessible using domain name from Windows 7

Posted on by Carol

I was asked to have a look at a strange DFS problem today – and eventually tracked down the cause to the Windows 7 Offline Files feature.

Some users were unable to access DFS via the domain name:  The error was

"\\mydomain.com\dfs is not accessible. You might not have permission to use this network resource"

However there was clearly no permissions issue. The users could access the DFS shares just fine via “\\dcname\dfs”.

Once I tried to net view the namespace the problem became clear:

net view \\mydomain.com

DFS   Disk   [Offline Share]
NETLOGON  Disk  Logon server share
SYSVOL  Disk  Logon server share

Windows 7 had become completely convinced that the entire DFS was “Offline” and that appeared to be that.

Instead of trying to figure out why this had happened I decided to disable Offline Files. This was the next problem – I went through the Control Panel and found the message “Offline Files is currently enabled” below a greyed out “Disable offline files” button.

In the GPO, “Allow or Disallow the use of Offline Files” was set to “Disabled”. According to the blurb: “If you disable this setting, Offline Files is disabled and users cannot enable it.”

However this was patently not the case. The setting was Disabled but Offline Files was enabled on the client. (I ran the Resultant Set of Policy tool on the client to confirm it really was inheriting the GPO setting – it was.) As far as I can tell, all this setting does is disable the ability to change the state of Offline Files – without actually disabling Offline Files!

Finally I had to set the GPO option to “Not configured”. After that I could disable Offline Files on the client and, finally, DFS is accessible!

But the last irritation is that I had to unconfigure this setting in the global GPO. There is no way to override an “Enabled” or “Disabled” with a “Not Configured” at a sub-OU level.

I've been doing IT for 30 years, and IdM for 15. I live in Australia and build IdM solutions based on Microsoft Identity Manager. I also play the violin, but that doesn't help much with the IdM solutions.

2 Replies to “DFS shares not accessible using domain name from Windows 7”

  2. Fantastic post. Thank you so much for this. We had a single Windows 7 PC at a branch office that could not access the DFS shares through \\domain\namespace (it could through \\server\namespace however). I have been scratching my head all day over this and your solution worked for us. Many thanks!

Comments are closed.