Hi all,

Suddenly out of the blue, when a user connects to his files through Netstorage the rights is to one of the mappings is removed by Internal NCP Server Connection (as seen in file servers ncpserv.audit.log)

This do not happen when he access other mapping and only happens when using netstorager (browser does not matter).

Netstorage server: SLES10 sp3 oes2 sp3

file server: SLES10 sp3 oes2 sp3

output from ncpserv.audit.log



name="directoryCache" timestamp="Thu Apr 14 16:22:13 2011 PM CEST" errno="0">

<Trustee_Operation type="string">Remove Trustee</Trustee_Operation>

<Connection_Number type="int">1985229328</Connection_Number>

<Connection_User type="string">Internal NCP Server Connection</Connection_User>

<Target_User type="string">.BILDARKIV.Groups.org_unit</Target_User>

<Volume_Number type="int">254</Volume_Number>

<Target_Path type="string">/Bildbank/B. Produktion t o m 2010</Target_Path>

<Removed_Rights type="unsignedInt">0xDB</Removed_Rights>

</libncpengine>

<libncpengine name="directoryCache" timestamp="Thu Apr 14 16:22:13 2011 PM CEST" errno="156">

<Trustee_Operation type="string">Remove Trustee</Trustee_Operation>

<Connection_Number type="int">1985229328</Connection_Number>

<Connection_User type="string">Internal NCP Server Connection</Connection_User>

<Target_User type="string">.BILDARKIV.Groups.org_unit</Target_User>

<Volume_Number type="int">254</Volume_Number>

<Target_Path type="string">/Bildbank/B. Produktion t o m 2010</Target_Path>

<Removed_Rights type="unsignedInt">0x0</Removed_Rights>

</libncpengine>

</forensics>