This is related to this question:
I have a member server in a brand new AD lab environment.
I have an Active Directory user
ADMIN01who is a member of the
Domain Adminsglobal group is a member of the member server's local
The following permissions are configured on the root of my new
D:drive added after the server became a member of the domain:
Everyone - Special Permissions - This folder only Traverse folder / execute file List folder / read data Read attributes Read extended attributes CREATOR OWNER - Special Permissions - Subfolders and files only Full Control SYSTEM - This folder, subfolders and files Full Control Administrators - This folder, subfolders and files Full Control
Under the above ACL's the domain user
ADMIN01 can logon and access the
D: drive, create folders and files and all is good.
If I remove the
Everyone permission from the root of this drive then non-built-in users who are members of the
Domain Admins (e.g.
ADMIN01) group can no longer access the drive. The domain
Administrator account is fine.
Administrator and the
Domain Admin "Administrator" account still have full access to the drive, but any "regular" user who has been added to
Domain Admins is denied access.
This happens regardless of whether I created the volume and removed the
Everyone permission logged in as the local machine
Administrator or whether I perform this logged on as the
Domain Admin "Administrator" account.
As mentioned in my previous question, the work around is to disable the "User Account Control: Run all administrators in Admin Approval Mode" policy either locally on the member server or via a domain wide GPO.
Why does removing the
Everyone account from
D:'s ACL cause this problem for non-built-in users who are granted membership of
Also why aren't these types of non-built-in
Domain Admin users prompted to elevate their permissions rather than just being flat out denied access to the drive?