Windows Server 2008 R2 Thread, Global Desktop Help! Urgent! Urgent! in Technical; Right, just created a major problem and somehow changed the security settings on our Global desktop folder. Users now do ...
19th May 2011, 04:53 PM #1
Global Desktop Help! Urgent! Urgent!
Right, just created a major problem and somehow changed the security settings on our Global desktop folder. Users now do not have access to the desktop (messasge when logging on) and I cant seem to change any of the security settings.
Was just checking the security settings as someone had managed to add a folder to the desktop and now I 've obviously changed something!!!!
Cant seen to change any security and now even logging on as domain admin I cant even view the contents. Tried a restore from back up, thought that would add previous security but no joy. Any suggestion...fast...welcome!
It says in folder properties that Administrators and Administrator have all allowed permisssions and pupils only the usual read/view etc.
How do I change it back?
Could I rename the folder (destroying the share) then restore the original from backup but would it recreate the share etc or would I be in a worse position? Clutching at straws now!
IDG Tech News
19th May 2011, 05:15 PM #2
Right, looked at it and found that I must have set admins and users Deny via Security/Advanced/Type was set to Deny. Now set it to Allow and users can load the desktop and as admin I can change settings, however...a general user can now add things to the desktop. What do I need to do as I dont want to end up where I was 10 mins agon, got enough grey hair!
19th May 2011, 05:20 PM #3
adding a write deny for teachers/students should sort it, other than that use the effective permissions options to see what certain users can do as you tweak the perms
Last edited by Jamman960; 19th May 2011 at 05:20 PM.
19th May 2011, 05:32 PM #4
Now, looking at the perms (properties, security tab) I have the pupil group with Read/Execute, List and Read yet they still can add to the desktop? Now they are local admins and in the desktop folder I have a Administrator and domain\Administrators group with full control should that have any bearing on it or should I only have domain\administrator group in the list?
Getting headache now! If I need tio change perms can I have dummy instructions please
Would a restore from backup cure all now I can actually write and view the folder?
Edit: Think I have it now, re-read your post and added the Write Deny, was thinking just not ticking the allow write would do it, hey ho!
Last edited by TechSupp; 19th May 2011 at 05:36 PM.
19th May 2011, 06:12 PM #5
Not ticking the allow write should do it but it sounds as though one of the groups they are members of still has write permissions, I'd be very carefull giving non-admin users local admin rights, if you really have to give them extra perms for some reason try giving them power user rights first or give them extra access to specific folders/registry keys via GPO's.
I would have thought deleting and restoring would reset the permissions although they may just inherit the perms from above.
Last edited by Jamman960; 19th May 2011 at 06:16 PM.
Thanks to Jamman960 from:
19th May 2011, 07:34 PM #6
Thanks, as i said done the deny write and all ok so far. Thanks. Just for future ref if i had deleted the folder and its share would a restore from ntbackup 2008 have restored the.folder.permissions and share? Or would i have had problems restoring a share that already existed. Had that with printers not allowing a newprinter to have an old printers share name whicv was removed as printer had been deleted. Would have given you thanks but cant see the button somehow.
19th May 2011, 07:50 PM #7
It depends on what you restore, the share settings aren't linked to any meta data in the folders. If you the shares are gone you would also have to restore the share definitions back to the registry (HKLM\SYSTEM\CurrentControlSet\Services\LanmanServ er\Shares). Maybe the restore process would handle this for you but it's worth checking the before and after states to see exactly what went on. Folder permissions should be restored as long as you don't stage the restore across another file system that would strip the permissions, e.g. a FAT32 formatted memory stick.
21st May 2011, 06:12 PM #8
Just as an addition to this thread, I went to the only other school I have running a global desktop for pupil logons only and noticed it had the group 'everyone' with the ability to read, list etc but with write deny. It also has Administrators and pupils groups in with the usual read list etc but not deny write. I didnt set this up in the first place so can I get rid of the everyone as it seems daft to have it as to lock it down I have to have deny write for everyone group then when I want to change an icon I have to remnove the write deny, change icon then reset it. Not really looked at it much before because it just worked, now after my problem started to look a bit more closely.
By SimpleSi in forum CLEO
Last Post: 26th January 2010, 08:15 PM
By pritchardavid in forum Windows 7
Last Post: 17th January 2010, 10:46 AM
By button_ripple in forum Windows
Last Post: 6th June 2008, 02:49 PM
By gibboap in forum Hardware
Last Post: 7th December 2007, 12:27 AM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)