Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm hoping someone can help me with this NTFS permissions problem. The short version is that I can't write a new file in F:\SomeDir even though I seem to be granted full permissions via both the "Domain Admins" group and a second unprivileged group. The "Effective Permissions" tab in the explorer permissions UI shows that I have full control, and there are no "Deny"s anywhere in the ACL or anything else that looks unusual. I am logged into the machine over RDP and accessing the disk directly as a local drive, not through a share.

F:\SomeDir>set U
USERDNSDOMAIN=THEOFFICE.LOCAL
USERDOMAIN=THEOFFICE
USERNAME=thisisme
USERPROFILE=C:\Users\thisisme

F:\SomeDir>icacls .
. BUILTIN\Administrators:(I)(F)
  CREATOR OWNER:(I)(OI)(CI)(IO)(F)
  THEOFFICE\Domain Admins:(I)(OI)(CI)(F)
  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
  BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
  BUILTIN\Users:(I)(OI)(CI)(RX)

Successfully processed 1 files; Failed processing 0 files

F:\SomeDir>net group /domain "Domain Admins"
The request will be processed at a domain controller for domain THEOFFICE.local.

Group name     Domain Admins
Comment        Designated administrators of the domain

Members

-------------------------------------------------------------------------------
Administrator        thatguy                  thisisme
The command completed successfully.

F:\SomeDir>echo "whyUNoCreateFile?" > whyUNoCreateFile.txt
Access is denied.

I searched for answers and came across similar problems that lead to UAC (ex. Why does removing the EVERYONE group prevent domain admins from accessing a drive? ). I can't turn off UAC at the moment, so I try a "regular" group that I'm also part of. This group has no special rights assignments and is not part of any administrative groups. Still no dice:

[***** This one command executed in an elevated shell *****]
F:\SomeDir>icacls . /grant THEOFFICE\iteveryone:(OI)(CI)F
processed file: .
Successfully processed 1 files; Failed processing 0 files


F:\SomeDir>net group /domain "iteveryone"
The request will be processed at a domain controller for domain THEOFFICE.local.

Group name     ITeveryone
Comment        

Members

-------------------------------------------------------------------------------
Administrator       thatguy                    thisisme
otherguy                someitguy
The command completed successfully.

F:\SomeDir>echo y > u
Access is denied.

As you can see, using a "regular" group didn't help. I have logged out and back in to the server to ensure my login token is up to date, and at any rate I belonged to these groups before the server was created.

If I grant explicit permission to myself, it does allow me to write files:

[***** This one command executed in an elevated shell *****]
F:\SomeDir>icacls . /grant THEOFFICE\thisisme:(OI)(CI)F
processed file: .
Successfully processed 1 files; Failed processing 0 files

F:\SomeDir>echo y > u

F:\SomeDir>type u
y

My requirement is for the "Domain Admins" group to have Full Control, or if that's not possible without disabling UAC, then a second group will do, but I can't get either to work.

I'm really stumped. Can someone please point out what I could be overlooking?

share|improve this question
2  
Just to clarify, F: is a local drive and not a mapped drive. Correct? –  John Gardeniers Oct 13 '12 at 2:55
    
Yes, F: is a local drive –  chris613 Oct 13 '12 at 4:31

1 Answer 1

up vote 0 down vote accepted

So it turns out that this problem was exactly the UAC based problem described in the other article; the "ITeveryone" group didn't work for me because it was a "Distribution" group, not a "Security" group. I tried the same thing with a security group to which I was also a member and it worked as expected.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.