Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » Nested groups
Nested groups [message #390003] Fri, 12 February 2010 06:39 Go to next message
ThePro  is currently offline ThePro
Messages: 13
Registered: October 2009
Junior Member
Hi,

It seems to me W2K8 R2 has problems regarding file and folders permissions
and nested groups. Our domain has a mix of W2K8 R2 and W2K3 DCs.

From a RDP session on a member server itself, I try to browse to a folder
where the local "Administrators" group has full control. The "Domain Admins"
group is in the local "Administrators" group and my user is in the "Domain
Admins" group.

However, when I double-click the folder, I get this dialog box "You don't
currently have permission to access this folder". If I click "Continue",
explicit "Full control" permission is added to the folder for my user. But I
already have "Full Control" as per group membership !

If I access the same folder from a network share instead of locally,
everything is OK.

Any ideas why ?

Thanks.

ThePro
Re: Nested groups [message #390064 is a reply to message #390003] Fri, 12 February 2010 08:10 Go to previous messageGo to next message
meiweb  is currently offline meiweb  Germany
Messages: 2225
Registered: September 2009
Senior Member
Hello ThePro,

Locally or with RDC on a Windows server 2008 or Windows server 2008 R2 UAC
comes into play. Even if you are member of domain admins you belong to it.
So either disable it(of course not the best option with security) or configure
at least the GPO settings under:
Computer configuration, policies, windows settings, security settings, local
policies, security options, in the right pane "User account control:........."

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi,
>
> It seems to me W2K8 R2 has problems regarding file and folders
> permissions and nested groups. Our domain has a mix of W2K8 R2 and
> W2K3 DCs.
>
> From a RDP session on a member server itself, I try to browse to a
> folder where the local "Administrators" group has full control. The
> "Domain Admins" group is in the local "Administrators" group and my
> user is in the "Domain Admins" group.
>
> However, when I double-click the folder, I get this dialog box "You
> don't currently have permission to access this folder". If I click
> "Continue", explicit "Full control" permission is added to the folder
> for my user. But I already have "Full Control" as per group membership
> !
>
> If I access the same folder from a network share instead of locally,
> everything is OK.
>
> Any ideas why ?
>
> Thanks.
>
> ThePro
>
Re: Nested groups [message #390070 is a reply to message #390064] Fri, 12 February 2010 08:25 Go to previous messageGo to next message
ThePro  is currently offline ThePro  Canada
Messages: 13
Registered: October 2009
Junior Member
Thanks.

There is 10 different settings for "User Account Control". Which you do you
suggest I configure ?

"Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> wrote:
> Hello ThePro,
>
> Locally or with RDC on a Windows server 2008 or Windows server 2008 R2 UAC
> comes into play. Even if you are member of domain admins you belong to it.
> So either disable it(of course not the best option with security) or
> configure at least the GPO settings under:
> Computer configuration, policies, windows settings, security settings,
> local policies, security options, in the right pane "User account
> control:........."
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hi,
>>
>> It seems to me W2K8 R2 has problems regarding file and folders
>> permissions and nested groups. Our domain has a mix of W2K8 R2 and
>> W2K3 DCs.
>>
>> From a RDP session on a member server itself, I try to browse to a
>> folder where the local "Administrators" group has full control. The
>> "Domain Admins" group is in the local "Administrators" group and my
>> user is in the "Domain Admins" group.
>>
>> However, when I double-click the folder, I get this dialog box "You
>> don't currently have permission to access this folder". If I click
>> "Continue", explicit "Full control" permission is added to the folder
>> for my user. But I already have "Full Control" as per group membership
>> !
>>
>> If I access the same folder from a network share instead of locally,
>> everything is OK.
>>
>> Any ideas why ?
>>
>> Thanks.
>>
>> ThePro
>>
>
Re: Nested groups [message #390097 is a reply to message #390070] Fri, 12 February 2010 08:54 Go to previous messageGo to next message
meiweb  is currently offline meiweb  Germany
Messages: 2225
Registered: September 2009
Senior Member
Hello ThePro,

I didn't tried them until now, as we can live with UAC in place, as we are
not working that often on our servers directly.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks.
>
> There is 10 different settings for "User Account Control". Which you
> do you suggest I configure ?
>
> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> wrote:
>
>> Hello ThePro,
>>
>> Locally or with RDC on a Windows server 2008 or Windows server 2008
>> R2 UAC
>> comes into play. Even if you are member of domain admins you belong
>> to it.
>> So either disable it(of course not the best option with security) or
>> configure at least the GPO settings under:
>> Computer configuration, policies, windows settings, security
>> settings,
>> local policies, security options, in the right pane "User account
>> control:........."
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Hi,
>>>
>>> It seems to me W2K8 R2 has problems regarding file and folders
>>> permissions and nested groups. Our domain has a mix of W2K8 R2 and
>>> W2K3 DCs.
>>>
>>> From a RDP session on a member server itself, I try to browse to a
>>> folder where the local "Administrators" group has full control. The
>>> "Domain Admins" group is in the local "Administrators" group and my
>>> user is in the "Domain Admins" group.
>>>
>>> However, when I double-click the folder, I get this dialog box "You
>>> don't currently have permission to access this folder". If I click
>>> "Continue", explicit "Full control" permission is added to the
>>> folder for my user. But I already have "Full Control" as per group
>>> membership !
>>>
>>> If I access the same folder from a network share instead of locally,
>>> everything is OK.
>>>
>>> Any ideas why ?
>>>
>>> Thanks.
>>>
>>> ThePro
>>>
Re: Nested groups [message #390113 is a reply to message #390097] Fri, 12 February 2010 09:11 Go to previous message
ThePro  is currently offline ThePro  Canada
Messages: 13
Registered: October 2009
Junior Member
Hello,

BTW I tried to right-click "Windows Explorer" and "Run as administrator" but
I have the same issue.

"Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> wrote:
> Hello ThePro,
>
> I didn't tried them until now, as we can live with UAC in place, as we are
> not working that often on our servers directly.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Thanks.
>>
>> There is 10 different settings for "User Account Control". Which you
>> do you suggest I configure ?
>>
>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> wrote:
>>
>>> Hello ThePro,
>>>
>>> Locally or with RDC on a Windows server 2008 or Windows server 2008
>>> R2 UAC
>>> comes into play. Even if you are member of domain admins you belong
>>> to it.
>>> So either disable it(of course not the best option with security) or
>>> configure at least the GPO settings under:
>>> Computer configuration, policies, windows settings, security
>>> settings,
>>> local policies, security options, in the right pane "User account
>>> control:........."
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> Hi,
>>>>
>>>> It seems to me W2K8 R2 has problems regarding file and folders
>>>> permissions and nested groups. Our domain has a mix of W2K8 R2 and
>>>> W2K3 DCs.
>>>>
>>>> From a RDP session on a member server itself, I try to browse to a
>>>> folder where the local "Administrators" group has full control. The
>>>> "Domain Admins" group is in the local "Administrators" group and my
>>>> user is in the "Domain Admins" group.
>>>>
>>>> However, when I double-click the folder, I get this dialog box "You
>>>> don't currently have permission to access this folder". If I click
>>>> "Continue", explicit "Full control" permission is added to the
>>>> folder for my user. But I already have "Full Control" as per group
>>>> membership !
>>>>
>>>> If I access the same folder from a network share instead of locally,
>>>> everything is OK.
>>>>
>>>> Any ideas why ?
>>>>
>>>> Thanks.
>>>>
>>>> ThePro
>>>>
>
>
Previous Topic:SPAM
Next Topic:Does NTPClient need to be enabled for clients
Goto Forum:
  


Current Time: Fri Jan 19 00:45:09 MST 2018

Total time taken to generate the page: 0.02121 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software