+ Post New Thread
Results 1 to 8 of 8
Windows Server 2008 R2 Thread, Global Desktop Help! Urgent! Urgent! in Technical; Right, just created a major problem and somehow changed the security settings on our Global desktop folder. Users now do ...
  1. #1
    TechSupp's Avatar
    Join Date
    Mar 2007
    Location
    South Yorkshire
    Posts
    1,875
    Thank Post
    295
    Thanked 120 Times in 101 Posts
    Rep Power
    40

    Global Desktop Help! Urgent! Urgent!

    Right, just created a major problem and somehow changed the security settings on our Global desktop folder. Users now do not have access to the desktop (messasge when logging on) and I cant seem to change any of the security settings.
    Was just checking the security settings as someone had managed to add a folder to the desktop and now I 've obviously changed something!!!!
    Cant seen to change any security and now even logging on as domain admin I cant even view the contents. Tried a restore from back up, thought that would add previous security but no joy. Any suggestion...fast...welcome!
    It says in folder properties that Administrators and Administrator have all allowed permisssions and pupils only the usual read/view etc.
    How do I change it back?
    Could I rename the folder (destroying the share) then restore the original from backup but would it recreate the share etc or would I be in a worse position? Clutching at straws now!

  2. #2
    TechSupp's Avatar
    Join Date
    Mar 2007
    Location
    South Yorkshire
    Posts
    1,875
    Thank Post
    295
    Thanked 120 Times in 101 Posts
    Rep Power
    40
    Right, looked at it and found that I must have set admins and users Deny via Security/Advanced/Type was set to Deny. Now set it to Allow and users can load the desktop and as admin I can change settings, however...a general user can now add things to the desktop. What do I need to do as I dont want to end up where I was 10 mins agon, got enough grey hair!

  3. #3
    Jamman960's Avatar
    Join Date
    Sep 2007
    Location
    London/Kent
    Posts
    987
    Thank Post
    185
    Thanked 194 Times in 156 Posts
    Rep Power
    45
    adding a write deny for teachers/students should sort it, other than that use the effective permissions options to see what certain users can do as you tweak the perms

    James
    Last edited by Jamman960; 19th May 2011 at 04:20 PM. Reason: Spelling

  4. #4
    TechSupp's Avatar
    Join Date
    Mar 2007
    Location
    South Yorkshire
    Posts
    1,875
    Thank Post
    295
    Thanked 120 Times in 101 Posts
    Rep Power
    40
    Now, looking at the perms (properties, security tab) I have the pupil group with Read/Execute, List and Read yet they still can add to the desktop? Now they are local admins and in the desktop folder I have a Administrator and domain\Administrators group with full control should that have any bearing on it or should I only have domain\administrator group in the list?
    Getting headache now! If I need tio change perms can I have dummy instructions please

    Would a restore from backup cure all now I can actually write and view the folder?

    Edit: Think I have it now, re-read your post and added the Write Deny, was thinking just not ticking the allow write would do it, hey ho!
    Last edited by TechSupp; 19th May 2011 at 04:36 PM.

  5. #5
    Jamman960's Avatar
    Join Date
    Sep 2007
    Location
    London/Kent
    Posts
    987
    Thank Post
    185
    Thanked 194 Times in 156 Posts
    Rep Power
    45
    Not ticking the allow write should do it but it sounds as though one of the groups they are members of still has write permissions, I'd be very carefull giving non-admin users local admin rights, if you really have to give them extra perms for some reason try giving them power user rights first or give them extra access to specific folders/registry keys via GPO's.

    I would have thought deleting and restoring would reset the permissions although they may just inherit the perms from above.
    Last edited by Jamman960; 19th May 2011 at 05:16 PM.

  6. Thanks to Jamman960 from:

    TechSupp (19th May 2011)

  7. #6
    TechSupp's Avatar
    Join Date
    Mar 2007
    Location
    South Yorkshire
    Posts
    1,875
    Thank Post
    295
    Thanked 120 Times in 101 Posts
    Rep Power
    40
    Thanks, as i said done the deny write and all ok so far. Thanks. Just for future ref if i had deleted the folder and its share would a restore from ntbackup 2008 have restored the.folder.permissions and share? Or would i have had problems restoring a share that already existed. Had that with printers not allowing a newprinter to have an old printers share name whicv was removed as printer had been deleted. Would have given you thanks but cant see the button somehow.

  8. #7
    morganw's Avatar
    Join Date
    Apr 2009
    Location
    Cambridge
    Posts
    816
    Thank Post
    46
    Thanked 132 Times in 126 Posts
    Rep Power
    39
    It depends on what you restore, the share settings aren't linked to any meta data in the folders. If you the shares are gone you would also have to restore the share definitions back to the registry (HKLM\SYSTEM\CurrentControlSet\Services\LanmanServ er\Shares). Maybe the restore process would handle this for you but it's worth checking the before and after states to see exactly what went on. Folder permissions should be restored as long as you don't stage the restore across another file system that would strip the permissions, e.g. a FAT32 formatted memory stick.

  9. #8
    TechSupp's Avatar
    Join Date
    Mar 2007
    Location
    South Yorkshire
    Posts
    1,875
    Thank Post
    295
    Thanked 120 Times in 101 Posts
    Rep Power
    40
    Just as an addition to this thread, I went to the only other school I have running a global desktop for pupil logons only and noticed it had the group 'everyone' with the ability to read, list etc but with write deny. It also has Administrators and pupils groups in with the usual read list etc but not deny write. I didnt set this up in the first place so can I get rid of the everyone as it seems daft to have it as to lock it down I have to have deny write for everyone group then when I want to change an icon I have to remnove the write deny, change icon then reset it. Not really looked at it much before because it just worked, now after my problem started to look a bit more closely.

SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 2
    Last Post: 26th January 2010, 07:15 PM
  2. Really Need Urgent Help Please......
    By pritchardavid in forum Windows 7
    Replies: 4
    Last Post: 17th January 2010, 09:46 AM
  3. Urgent Help!
    By button_ripple in forum Windows
    Replies: 3
    Last Post: 6th June 2008, 01:49 PM
  4. Please Help URGENT
    By gibboap in forum Hardware
    Replies: 18
    Last Post: 6th December 2007, 11:27 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •