Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2008 R2 machine. My machine itself is not a domain controller but is joined to a domain.

In Local Security Policy, under Security Settings > Local Policies > User Rights Assignment, grant user DOMAIN\jane.doe to have "Take ownership of files or other objects" privilege.

I rebooted the machine and login as DOMAIN\jane.doe. Open up the command prompt and do takeown /f c:\test\testfile.txt. It gives me "Access denied" error

The file was created by DOMAIN\administrator. Hence the owner was set to Administrators group. Verified that there is no other GPO applied to the machine.

For testing purpose, I take out all DACL from the file and then just granted DOMAIN\jane.doe to have "Take ownership" permission via DACL. Then, login as DOMAIN\jane.doe and run the takeown /f c:\test\testfile.txt again. I could successfully take the ownership if the "Take ownership" permission is granted to DOMAIN\jane.doe via DACL.

My question is why does the user DOMAIN\jane.doe fail to obtain the file ownership even I granted her the privilege? Is it because takeown.exe doesn't honor the Windows privilege but only DACL? I did similar testing using the security property page from Windows Explorer. DOMAIN\jane.doe cannot take ownership even though she is granted to have "Take ownership" permission via DACL and she is granted to have "Take ownership of files or other objects" privilege.

share|improve this question
    
Is the machine a DC or does it have a GPO of its own? Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: Local policy settings Site policy settings Domain policy settings OU policy settings (sorry for the poor formatting, but this isn't an answer yet) –  TheCleaner Jul 16 '13 at 21:56
    
It's not a domain controller. I will check if there is GPO overriding the local GPO. –  Harvey Kwok Jul 16 '13 at 21:58

1 Answer 1

I just worked out the answer. It's because I had UAC turned on. If I turn off the UAC, both takeown.exe and explorer.exe security properties work as expected. DOMAIN\jane.doe can take the ownership as expected.

share|improve this answer
    
Good deal. Should also work then with UAC on if you open an elevated command prompt. –  TheCleaner Jul 17 '13 at 12:52
    
Yup - it works if I open an elevated command prompt –  Harvey Kwok Jul 18 '13 at 0:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.