Is this correct? domain admin needs to be added as a user not a group to folder secur

[TwistedHelixis]

I have just created a new domain admin account. On our file server if I log in with this new domain admin account and try to open a folder on our DATA drive I get an error that the user does not have permission and to click to give the user permission. If I click to give permission I can then access the folder but I can see the domain admin account has been added to the folder security and granted Full access.

 

My question - is it correct for the domain admin to be added like this when I already have domain admins group as full in the folder security.

[Steve21]

You got UAC on? If so it's "expected".

 

By default browsing to a folder on a secondary drive etc won't elevate your rights to domain admin and thus you have no access. (Unless explorer is run as admin! )

 

Directly adding the user bypasses this as it doesn't require the domain admin level etc.

 

Steve

[TwistedHelixis]

You got UAC on? If so it's "expected".

 

Hello Steve, UAC is off on the data server.

[Steve21]

When you say off do you mean set to Never Notify? Or actually disabled within the registry?

 

Steve

[bwestlake]

Its all down to NTFS Permissions, you can either add you account or as we do we create a security group in AD called "IT Services" then add our users too it, when we do our servers we set the NTFS permissions so that the "IT Services" Security group has Full Permissions on the folder

[Steve21]

Its all down to NTFS Permissions, you can either add you account or as we do we create a security group in AD called "IT Services" then add our users too it, when we do our servers we set the NTFS permissions so that the "IT Services" Security group has Full Permissions on the folder

 

That's a normal group though, not the Domain Admins one. So you don't need to elevate yourself via UAC etc (Still think that's the problem here as had it so many times at places).

 

Steve

[TwistedHelixis]

When you say off do you mean set to Never Notify? Or actually disabled within the registry?

 

It's set to never notify

[DavR]

I ran across this the other week, it was driving me mad, until I finally tracked it down to UAC.

 

UAC is a pain though, you may have turned the slider all the way down to never notify, but there's actually another setting to completely turn it off.

 

Under your local security policy, its under Computer Config | Policies | Windows Settings | Security Settings | Local Policies | Security Options. The setting is "User Account Control: Run all Administrators in Admin Approval Mode" - disable this.

[Areku]

Ill investigate this security policy...

[TwistedHelixis]

Under your local security policy, its under Computer Config | Policies | Windows Settings | Security Settings | Local Policies | Security Options. The setting is "User Account Control: Run all Administrators in Admin Approval Mode" - disable this.

 

Not at the school today but seem to remember making that change already. I'll post back in a few days

[TwistedHelixis]

Under your local security policy, its under Computer Config | Policies | Windows Settings | Security Settings | Local Policies | Security Options. The setting is "User Account Control: Run all Administrators in Admin Approval Mode" - disable this.

 

Just to confirm the above should be set from enabled to disabled?

[DavR]

Just to confirm the above should be set from enabled to disabled?

 

Yup, disabled.

 

This is the setting that means that even though you're an admin, it ignores all your admin credentials under a lot of circumstances.