Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a brand new Active Directory (CORP-AD) installation running on Windows 2008R2. I have a domain controller (PDC01) and a member server (ME01).

The member server has a C: and a D: drive.

Part of our standard build is to remove all permissions from the root of the D: drive except for:

SYSTEM         (Full Control)
Administrators (Full Control)

I created a new domain user ADMIN01 and granted it membership of the Domain Admins group.

Domain Admins is a member of the member server's local Administrators group.

When I logon (via RDP) to the member server ME01 as the domain user ADMIN01 this user cannot access the D: drive. I then tried adding the Domain Admins group with full control to the root of the D: drive but my ADMIN01 user still cannot access the D: drive:

enter image description here

If I logon to ME01 as a local machine administrator I have no trouble accessing the D: drive at all.

I discovered this question which describes more or less the same problem:

Why can't I browse my D: drive, even if I'm in the Administrators group?

The answer suggests correctly that this is a UAC privilege elevation issue but I'm puzzled by this statement, in particular the bold part:

You can modify this behaviour by Group Policy however bear in mind that the default is set that way intentionally - the specific policy you want to change is "User Account Control: Run all administrators in Admin Approval Mode" - you can find details on how to do this in this MSDN article.

Is this suggesting that "User Account Control: Run all administrators in Admin Approval Mode" should not be disabled?

If it's enabled I don't get a UAC challenge with the "Continue" button + shield icon, I'm just plain refused access to the drive. Is this normal?

share|improve this question
    
Your screenshot does not depict the access control entries for the Domain Admins (or Administrators for the matter) security group. You're showing only the ACEs for the SYSTEM built-in account. –  Sean C. Jul 21 '11 at 12:52
    
@sean - I know the reason now, but I don't understand why: serverfault.com/questions/292663/… - I did mention earlier in the question that SYSTEM, Domain Admins and Administators have full control. The image doesn't really add much I admit. –  Kev Jul 21 '11 at 13:15

5 Answers 5

The reason, although I don't understand why, seems to be caused by removing the built-in Everyone group from the D: drive permissions.

I've followed this up with a new question:

Why does removing the EVERYONE group prevent domain admins from accessing a drive?

share|improve this answer
    
Good question. I'm confused though, in your initial post you only listed only SYSTEM and Administrators as having permissions on the D drive. Was "Everyone" in that list too? –  Lucky Luke Jul 22 '11 at 21:59
    
In the above question only SYSTEM and Administrators had permissions on the d: drive. –  Kev Jul 22 '11 at 22:30

Looks like it's not actually a UAC problem but someone has messed around with the permissions on the drive level.

I would log in as the local admin, then compare the permissions that are set on both the C: and the D: drives, i'll bet that the Domain Admins either where removed, or they have been explicitly denied.

share|improve this answer
    
No, the Domain Admins group wasn't removed. Even with Administrators and Domain Admins given full control of d:, my ADMIN01 user can access the drive only if I turn off Run all administrators in Admin Approval Mode . This is a brand new build, nothing else has been touched. –  Kev Jul 21 '11 at 0:22

It sounds like someone granted Administrator not Administrators full control.

share|improve this answer
    
Nope, it was definitely Administrators, it was me that built the server. –  Kev Jul 21 '11 at 0:19

Did you actually completely log off as user ADMIN01 after you made the group membership changes and added the user to the Domain Admins group?

You mentioned remote desktop a lot, maybe the session for the user was just disconnected, and group membership changes don't take into effect until the user completely logs off and logs back on (with Windows it's also possible to have two sessions open at the same time).

Does the ADMIN01 user have access to other administrative tools that only domain admins normally have access to? That would rule out whether it's a ACL issue on the drive, or a group membership/permission issue.

share|improve this answer
    
Not just logged off, but rebooted the server too. –  Kev Jul 21 '11 at 8:34

In a TechEd presentation this year, someone from Microsoft essentially suggested that if your admins know what they are doing, you can disable UAC on servers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.