u/mpethe

We have a couple of trials going and in both instances users have a requirement to access various file servers via mapped drives.

In both cases we have issuses where they connect to CSE and are not able to access mapped drives.

Sometimes - clicking on the drive either gives the 'device already in use' error, or it prompts for says the drive is 'not accessible. the system cannot conact a domain controller'. Remapping the drives tends to make them accessible again.

We have tried adding Kerboros and LDAP ports to the access policy, but I'm not sure if this is the correct path to pursue.

We are working with pre-sales tech engineers but they haven't had many helpful suggestions yet.

Anyone seen this?

.*************.

UPDATE: This entire issue seems to be intermittent. We were working with a test PC this moring, testing the remapping script, and were running into more issues. Tried same PC again this afternoon, and now we can't even recreate the original issue. Everything is working as expected. For those suggesting that we may not have some needed port opened - that does not appear to be a factor. We have had the drives mapped working with as little as 1 server port 445 open and nothing else.

We have a client that we're looking to deploy CSE for.

They have multiple groups of users that require access to various resources.

For example...

Users in GroupA may need RDP access to server1 and file share access server2

Users in GroupB may need RDP access to sever1 and RDP access to server3

Users in GroupC may need RDP access to their own PC and file share access to server2.

We don't just want one Access Policy/Tunnel that is wide open for the subnet. We also don't want users to have to switch Tunnels to access various resources.

Does it make sense to follow the principle of least privilege? Or do we just consider that a user in GroupA (for example) has limited access based on RDP and NTFS permissions on the various hosts they could attempt to connect to?

Does building a service tunnel for each unique type of user/group make sense? Would you build it this way if there were 10+ distinct groups? 20+?

This approach adds on administrative overhead, and is it even worth it?

Thanks!

My son is starting at Mohawk in the Fall of 2026.

We have money set aside in an RESP to help pay for school. The RESP is requesting a VoE (Verification of Enrolment) before they will release the funds. This makes sense.

After getting his Mohawk ID and login info, we had him fill out the VoE form. We just heard back that the request was denied because he has not filled out his timetable yet. Ok, fine I guess.

However, when I Google how he can fill out his timetable, it says that he can do so after paying all tuition and fees.

So, I can't get the VoE to get the money released I need to pay the fees until we pay the fees. How does this make sense?