Weird file permission issue

[ADMaster]

I noticed a few weeks ago as administrator I had access denied to the entire E: and F: drives of my file server, but I could access the shares.

 

I looked at the security tab and the servername\administrators had full control.

 

Today I'm working on a new file server and using the copyall flag in robocopy as the majority of the files are home directories. From the file server I cannot access any of the files including my admin install share. However if I access it from another computer via the share path I have full access.

 

Again the acl shows \\newservername\administrators with full control and the share permissions are everyone full.

I have verified domain admins is in the local administrators group.

 

Did something with permission behavior change I'm not aware of? The old server is 2016 the new is 2019.

[jthompson]

Yeah, I think this is some new expected behaviour, perhaps to mitigate ransomware type attacks. I spotted this when migrating some file shares to a new 2019 server. I'd used Storage Migration Service, so the permissions were all 'correctly' duplicated.

 

If you create a new AD group for your admin users (e.g."FileShare Administrators") and add that to the security for your new drives, just as with your existing admin group, you should be okay. Whether that's best practice, though, I can't say.

[kevin_lane]

That does sound a bit strange how has it been since the change in permissions still ok?

[jthompson]

I believe UAC is behind this issue. https://superuser.com/questions/929318/secured-drive-only-available-if-windows-explorer-is-run-as-an-administrator

[ADMaster]

The 2019 server didn't have any issue with the root of the drive like 2016 did.

If I attempt to enter a home directly I am prompted to grant myself access.

I tried running explorer as admin briefly but could not. I launched powershell as admin and launched explorer from there but was still given access denied. However I could navigate the home directories with elevated powershell.

 

The staff have not had any trouble accessing their own directories and I can access them over the network. Students will return Tuesday.