ACCESS DENIED on .lnk operations over network drives, only inside Parallels RAS sessions Environment

B

BorisS2

Bit poster
Hi Forum,

Environment
  • Windows Server 2025
  • Parallels RAS 21.2.1, Build 27310, Security Patch 1
  • RD Session Host: RDSH01, Windows Server Build 26100.33296
  • File server: FILESRV01, affected path \\FILESRV01\share\Support
  • FSLogix (current version) for profiles
  • Microsoft Defender for Server P2 on the RAS hosts (temporary deactivated)
Symptom (only inside a Parallels RAS session)
  • Existing .lnk files on network drives show as blank white sheets, not recognized as shortcuts, double click does nothing
  • Creating new .lnk files on network drives fails with "insufficient permission for the action"
  • Copy/paste of .lnk files to network drives fails
  • Renaming .txt to .lnk on the network drive fails
  • Other file types, for example .txt, work without issue
  • Locally on the RDSH (C:\Temp, %TEMP%) .lnk creation and usage works fine
Key differentiator (same user, same RDSH, same UNC path)
  • Direct RDP logon to RDSH01: works
  • Logon via Parallels RAS to the same host: fails
  • Logon on Citrix workers (Citrix UPM, Defender for Server P2): works
  • Only the combination Parallels RAS session plus network path triggers the issue
Already tested and excluded as root cause
  • NTFS/share permissions, .lnk registry (HKCR\.lnk = lnkfile, IsShortcut present)
  • Kerberos and SMB: valid AES-256 ticket for cifs/FILESRV01 issued in the RAS session, no NTLM fallback
  • User token compared via whoami /all between RDP and RAS: identical SID, groups, integrity level, privileges
  • Password based RAS logon instead of certificate/SSO: no change
  • Defender: completely disabled for testing, the error persists unchanged; earlier a temporary exclusion for the UNC test path also made no difference, and no ASR, Controlled Folder Access, Network Protection or AV block was logged at the time of failure
  • Empty client policy with highest priority, no forced session settings, full logoff and reconnect, client URL/mail redirection disabled, Windows Shell URL namespace feature thereby excluded
Procmon findings
  • Creating a shortcut: explorer.exe CreateFile on \\FILESRV01\share\Support\New Shortcut.lnk, Disposition Create, result ACCESS DENIED
  • Renaming .txt to .lnk: IRP_MJ_SET_INFORMATION, SetRenameInformationFile to the .lnk target name, result ACCESS DENIED
  • Denial is specifically tied to the .lnk target name/extension
  • Stack shows FLTMGR.SYS, ntoskrnl.exe, ntdll.dll, KERNELBASE.dll, windows.storage.dll, SHELL32.dll, explorerframe.dll, no third party filter driver clearly attributed
Question to the community/support
  • Why does the exact same user, on the same RDSH and same UNC path, succeed via direct RDP but fail with ACCESS DENIED exclusively inside a Parallels RAS session, limited to .lnk operations on network drives while other file types work?
  • Are there known issues with .lnk handling on UNC/SMB paths in RAS 21.2.1 Build 27310 on Windows Server 26100.x, or a hotfix/newer build addressing this?

I want to move away from Citrix and switch to Parallels RAS :-)
Greetz
Boris
 
You must log in or register to reply here.
Back
Top