Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a shared folder on a Windows Server 2003 Machine, and tried accessing it from a remote Windows 7 machine. The user is part of the AD, and the sharing permissions are 'Modify' to everyone. I added the user to a Domain Local group and gave the group NTFS 'Modify' Permission on the folder - the user can't edit content. But when I specifically added the user to the NTFS permissions and gave him 'Modify' - the user could change the content. The group has no other permissions delegating to it. Also I checked the effective permissions on the user when the group had the permissions and he had 'Modify' delegated to him.

I checked with senior admin but he has no idea.

share|improve this question
You should be able to add the users group to the share then security settings allow authenticated users/domain users change/modify – Branden May 23 '11 at 5:30

I normally see this issue when one step has been overlooked. After adding the user to the domain (or any other) group the user must log off and back on again before the group membership will take effect.

share|improve this answer

I'm in agreement with John that the user has not likely logged off yet. The user's combined Share and NTFS permissions are MODFIY, so that should not be the problem. You can verify if the user has the new group in their security token by running gpresult /r and checking if the domain local group appears.

share|improve this answer
Is there a way to force an update, such as GPUPDATE with group policy? – Dean May 24 '11 at 6:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.