Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Really wierd issue this one. I have a user whose PC I have just joined into a domain which is simply a single Windows 2008 R2 server.

All users is map to a SHARE that contains their home folders so each user should only see his/her own folder. But for this user after she logon to the domain from her PC, she is able to access all the other users home folders with full permissions!

I have checked her grouping and share+ntfs permission - all seem correct; effective permission on her account show everything is in order and that she does not have access to any folders except her own. Other users are not having this issue.

Here comes the wierd part:

  • If she use another PC, her access to other folders on that same SHARE are correctly restricted.

  • If another user logon from her PC, that user access is also correct.

  • But if she logon from her own PC, she get full rights to the server!

How can this be happening?

share|improve this question

migrated from security.stackexchange.com Jan 22 '13 at 9:05

This question came from our site for Information security professionals.

    
Weird problem. So weird that it sounds like there's a facepalm kind of answer to it. –  Henning Klevjer Jan 22 '13 at 8:18
3  
I think this one might be better for Serverfault –  Lucas Kauffman Jan 22 '13 at 8:19
1  
I'm not a experience Windows guy so any facepalm answer will still be welcomed. –  mike931 Jan 22 '13 at 8:27
    
is she an admin of her own PC? –  ratchet freak Jan 22 '13 at 8:41
1  
What rights does she have locally on that machine? Has she been assigned any extended rights on the machine under local group policy\computer configuration\security settings that may be impacting on things? –  RobM Jan 22 '13 at 9:51
show 2 more comments

3 Answers

If the homefolders are stored on the local disk, it might be that you have set her permissions to local administrator.

share|improve this answer
    
All users home folders are on the w2k8r2 server and accessible by a share. Its this share thats giving her excessive full access but all the permission properties i've checked looks ok. –  mike931 Jan 22 '13 at 8:58
    
You say that the share is on a server. And that her computer is a server. Are they in fact the same server? –  longneck Jan 24 '13 at 1:27
    
Her computer is a normal Windows 7 PC. Server is Windows 2008R2 with folders shared out. If she logon from her PC to the domain, she get full access to the servers' share when she should not. –  mike931 Jan 24 '13 at 6:45
add comment

You have to run some basic tools to check the rights.

  1. Test Effective File/Folder permissions. That is both share and ntfs.
  2. Run RSOP for that user to evaluate group policies. Also check mappings and verify no permissions from elevated groups (if the user was in several groups and recently demoted) are not overlapping.
  3. Check effective permissions for each group that the user is a member of.
  4. Try resetting user account. Check logon scripts as well.
share|improve this answer
    
Thanks I will read up on RSOP. How do I reset a windows user account? BTW I have already check the basic obvious stuff like share/ntfs permission, group membership. –  mike931 Jan 23 '13 at 4:51
1  
Simply disable, reset the password and re enable the profile. If the user is using a roaming profile, please check the settings as well. Re map all the mapped folders and printers. Apply a deny permission for the other shares which the user has exclusive access and check whether it propagates to this specific share (overlapping). –  Lasith Jan 23 '13 at 20:00
    
Additionally, reset the computer account and check. This is not necessary but I am suspecting a different possibility. Thank you! –  Lasith Jan 23 '13 at 20:02
    
I have reset the user account and computer account but it is still having full admin rights to the server's shares. I have also run gpresult /v on the pc but not sure what i should look out for. Any further hints? –  mike931 Jan 29 '13 at 10:42
    
Run the command after login as that specific user on Windows 7. When running the gpresult, you should also use /r option. Or else, if you wish to perform remotely, please use /user [<TARGETDOMAIN>]<TARGETUSER> parameters. That should reveal any hidden configuration. You could also use auditing to understand the access behavior. Enable auditing for the specific share. –  Lasith Jan 29 '13 at 12:21
add comment

This can occur when the Windows Fast Logon Optimization feature causes Windows Explorer to start before the logon scripts run. Having the Group Policy setting of ‘Run Logon Scripts Synchronously’ enabled and the setting ‘Always wait for the network at computer startup and logon’ settings enabled should fix this issue as described in this Microsoft Support Article.

More information on managing settings with Group Policy can be found on the Manage and Operate Windows 7 page of the Springboard Series on TechNet.

Hope this helps

share|improve this answer
    
Could you expand on that? I can't envisage a situation where logon scripts being bypassed would affect a user's security group membership or effective permissions on a filesystem. –  Chris McKeown Jan 23 '13 at 21:17
    
It appears that I may have misunderstood the question. I had interpreted this question as being an issue where a user is mapped to \\server\share\username, but the mapping actually ends up being \\server\share (one level up). My answer was not referencing the permission issue directly. –  WinOutreach4 Jan 24 '13 at 19:22
    
However, with that said, I agree with Lasith. But, the RSOP page on TechNet shows that RSOP doesn’t include all settings for any OS after Vista SP1, and that you should use Group Policy Results or Group Policy Modeling options in the Group Policy Management Console, or use the GPResult command line tool. –  WinOutreach4 Jan 24 '13 at 19:22
    
I have run gpresult /v on the pc, what should i look for to figure out how the user is getting admin rights? –  mike931 Jan 29 '13 at 10:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.