Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm seeing some weird behaviour with a few of my ACEs at the minute, particularly when denying the Authenticated Users instead of the usual Domain\Domain Users. As a consequence of this, I can only fix my problem by allowing the SYSTEM group at a lower level.

It seems Authenticated Users is blocking something that my application needs within SYSTEM.

Where do Authenticated Users and SYSTEM overlap?

share|improve this question
up vote 1 down vote accepted

The SYSTEM account is a member of the Authenticated Users group on the local machine. It is not a member of the Domain Users group (because it's not a domain account).

Why can't you use Domain Users to get the behaviour that you want?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.