Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a domain group (called GSG_TECH_USER) which need "full control" right to the folder "document & setting" of all servers and workstation.

I made a test with this configuration:

  • On a workstation, add a local group LSG_PROFILE_RW
  • Add the domain group GSG_TECH_USER to LSG_PROFILE_RW
  • Go to the security of "Document & Settings" folder
  • Add the group LSG_PROFILE_RW with "full control"
  • Apply & test

Of course, the test fails, because inheritance is not checked for "doc & settings" folder.

Do you have any ideas ?



GSG_TECH_USER needs full control on folders & subfolders of "doc & settings". In other words, on all profiles.
More precisely, GSG_TECH_USER should be able to create folder in %USERPROFILE% (c:\doc&setting\user\) of all the profiles present in the computer. In this created folder, it should be able to create files & folders.
The users of GSG_TECH_USER are technical users, not human users; so local admin rights is a solution, but not the best.

share|improve this question
Do they need full control of JUST the Documents and Settings folder, or the folder and all of its subfolders? – phuzion Jun 25 '10 at 17:24
Full control for the folders & subfolder – podosta Jun 28 '10 at 7:06
up vote 0 down vote accepted

Create a domain group and add the domain group to the local administrators group.

share|improve this answer
I'm going to assume that there is a legitimate reason for not wanting to give full local admin to these people. Least privilege, man! – phuzion Jun 25 '10 at 17:23
i'm assuming that too, but since the OP didn't specify his security requirments I thought I'd put this out there. Let the OP do some work in describing his security needs instead of all of us having to write a thesis on it for him. – joeqwerty Jun 25 '10 at 17:31
edit made, more details available, tell me if you need more – podosta Jun 28 '10 at 7:56
And I used the GPO/Restricted Groups functionallity – podosta Jun 29 '10 at 8:31

Any chance you can just throw them in backup operators? Not the best solution, but it prevents them from having administrator, while still giving them full R/W access (though to all files on the system!!!)

share|improve this answer
It's not working .. – podosta Jun 28 '10 at 7:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.