Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

The ACEs on our default administrative shares (C$, D$ etc.) suggest that the Users group has read/write access to the disk roots. In practice though it appears that only Domain Admins group can actually open these shares at the root.

How are the effective permissions controlled and why is it set up this way? Is it to establish explicit permissions for inheritance purposes?

share|improve this question

2 Answers

up vote 7 down vote accepted

While the NTFS ACLs on those items are permissive, the share ACLs on these default system shares are always set to allow just the local Administrators group (which contains the Domain Admins group).

The permissions on these items cannot be modified.

share|improve this answer
Thanks - any idea where this is documented? It would be useful to know because it looks contradictory unless one knows that the permissions are baked in. – zen Jun 30 '11 at 21:30
1  
@zen All file shares have two ACLs that govern access; the NTFS ACL and the file share ACL; you'll run into these seemingly contradictory situations often unless you check both. These special file shares' ACLs behave the same way, they're just also hidden. – Shane Madden Jun 30 '11 at 21:35
ok - thanks, now I get what you mean – zen Jun 30 '11 at 21:39
up vote 6 down vote

The permissions for those default admin shares are hard coded in Windows and can't be changed (at least not successfully).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.