Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Windows 2003 single domain.
A share located on a server have full rights for every authenticated users.
Under this share, a folder is read-only for everyone (except buitlin\Administrators group).
Everything work as intended.

I discovered one user who, from his Windows 7 pro workstation, have full access on this folder. He can do whatever he wants. If he log on another computer, he have read-only access.
When I display effective rights for this user FROM his workstation, I see he have every boxes checked. When I display the same thing from the server, I see correct rights.

This user belong to the builtin\Administrator group of his computer (we have to. You know, some software are very very bad).

Any idea about the fact this user have full rights only from his workstation ?

screenshots of various security settings

share|improve this question
    
Which "Administrators"-group? Builtin\Administrators? Pleases clarify both administrators groups. –  Tom Feb 14 '12 at 12:24
    
Please upload a screenshot of the NTFS and Share permissions for the folder in question. –  Dan Feb 14 '12 at 12:33
    
Done. I don't think this will help. –  Gregory MOUSSAT Feb 14 '12 at 13:28
    
What domain groups is this user a member? –  gWaldo Feb 14 '12 at 13:32
    
This user is not a member of any domain groups. –  Gregory MOUSSAT Feb 14 '12 at 16:56
add comment

2 Answers 2

up vote 1 down vote accepted

The fact that the user only gets this extra access from a single workstation, and doesn't get it from any other is an interesting diagnostic. It tells me that there is something up with that workstation that is causing this to happen.

One check that is worth doing is verifying what user he is logging in as. You can do this from the Current Sessions listing in Computer Manager. It may take some work, but verify he is logging in as himself. If that doesn't work, have him create a file on that share and check to see who owns it. This should shed some light on the problem.

If it turns out he's logging in as the wrong user somehow, it could be that his workstation isn't actually domained and there is a misalignment on the username translation. On the 2003 server's security settings, the 'share model' may be set to allow unknown users to emulate a specific user.

share|improve this answer
    
I just tested the same user on another workstation: everythink is normal. The user can't write the protected files. So the problem real seem to come from the initial workstation. I will run your suggested test tomorow, when I could access this computer again. –  Gregory MOUSSAT Feb 16 '12 at 11:38
    
I did the test as you suggested: create a file from the faulty workstation and... well, today everything is normal. The user can no longer write where he mustn't. So I don't know what was wrong. –  Gregory MOUSSAT Feb 24 '12 at 9:16
add comment

It looks like someone gave him local admin privileges on his workstation. Right click on My Computer > Manage > Local Users and Groups, you can check there to see who's under the Administrators group.

share|improve this answer
    
This user is local admin of his own workstation. This is stated in the question. But this don't explain why the problem exist. Other users are local admin too, without this problem. –  Gregory MOUSSAT Feb 14 '12 at 16:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.