The ACEs on our default administrative shares (C$, D$ etc.) suggest that the Users group has read/write access to the disk roots. In practice though it appears that only Domain Admins group can actually open these shares at the root.
How are the effective permissions controlled and why is it set up this way? Is it to establish explicit permissions for inheritance purposes?