Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

having permission issues for 2 users using active directory.

added 2 new users to ourdomain.controller/users folder.

The 2 users were auto. added to the Domain Users Group.

Went to the local G:/ drive on the AD machine. The Domain Users group is read only permission to the G:/ drive, exactly what I want.

Went into G:/rw and edited security/permissions. Removed inherited permissions and added the 2 new users and gave them read/write. Why can't the user write to this folder when the map G:/ ?? Access denied.

I even go to G:/rw, properties/security tab/advanced/effective permissions then select the 2 new users and the full control permission is checked.

Any help would be appreciated.


share|improve this question
are the share permissions correct? Or just read only? – TheCleaner Jul 26 '13 at 17:28
i went to g:/rw properties/sharing/advanced/permissions and added the new users and gave full control – dan Jul 26 '13 at 17:32
up vote 3 down vote accepted

You need to fix the share permissions.

Set your share permissions as follows:

DOMAIN ADMINS = Full Control


Then your NTFS permissions will still be in effect and lock down the root directory as you wanted.

It's pretty irrelevant to mess with share permissions at all. The above is how I set EVERY share and then just use the NTFS permissions to lock down the actual access.

share|improve this answer
properties/sharing indicates who can map, properties/security indicates who can read/write. Thanks for the help, this is exactly what I was looking for. – dan Jul 29 '13 at 16:36

I suspect someone is going to come along and close this as a duplicate, as I'd be shocked if no one ever asked this before, but...

You need to assign both NTFS level permissions (what you're talking about) and share level permissions. It sounds like your users don't have write access on the share level.

If the other users do have write access, it's possible that they're a member of a Windows security group that these two aren't.

share|improve this answer
on the g:/ share level perms, I don't want the 2 new users to have write to root, just g:/rw. do I add the new users with write to root directory? – dan Jul 26 '13 at 17:36
What TheCleaner said, basically. The share itself should be write/modify, the top level of G should not have any permissions beyond read, and then you can add the write privileges to the subdirectory. – Katherine Villyard Jul 26 '13 at 17:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.