Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here is a quickie that has had me scratching my head. Not a showstopper, so an answer isn’t urgent, but still.

I am trying to modify the logon scripts directory to include a login script. I have gone with Remote Desktop into my Domain Controller, and I am using a specially-created administrative account (something that wasn’t there when the domain was crafted) that is a part of the following groups:

  • Administrators (builtin)
  • Enterprise Admins
  • Domain Admins
  • Domain Users
  • Group Policy Creator Owners
  • Scan Operators
  • Schema Admins

Unfortunately, I cannot create any files within the following folder:

\\domain\SYSVOL\domain\{policy}\Machine\Scripts\Startup

And yet, if I log on using the original Administrator account which was used to set up the domain in the first place, I can! In fact, the original Admin account can do a lot that the (apparently) identical special-purpose superadmin account can’t. I mean, WTF?? Both accounts are absolutely identical in terms of the groups they belong to, as well as the organizational unit they are a part of, so I am unsure as to what the frakking difference is.

In fact, the only way to actually place a script there is to go through the drive itself:

C:\Windows\SYSVOL\sysvol\domain\Policies\{policy}\Machine\Scripts\Startup

share|improve this question
    
Does the related GPO have any Security Filtering on it? –  jscott Dec 10 '13 at 19:34

3 Answers 3

NTFS File permissions and "Share" Permissions are two different things. When you go to the actual folder (c:\windows..Startup) you are using NTFS permissions, which you clearly have rights to.

When you, however, are trying to edit \domain\Sysvol..., you are going to one of the DCs which probably does grant access to the the account you are using.

In short, I would look at share permissions for the issue you are describing. Here is a KB article explaining the diff: http://technet.microsoft.com/en-us/library/cc754178.aspx

share|improve this answer

I've run into something similar a few times before.

The logon scripts directory may be inheriting some permissions that are preventing you from having full control. Take ownership of the directory with your Domain Admin account, set the permissions the way you like, and you should be able to add your scripts.

share|improve this answer
    
Grogan Jr - Both Enterprise Admins and Domain Admins have full control over the directories. Ownership, however, is set to Administrators (DOMAIN\Administrators); but this doesn’t explain why going through the file system works while going through the UNC path does not. –  René Kåbis Dec 8 '13 at 19:08
    
Just also confirmed - taking ownership (to Domain Admins) does NOT work! FS file add still works, UNC file add is still prevented (“You need permission to perform this action” - no additional information given). –  René Kåbis Dec 8 '13 at 19:12

Take ownership, preferably in gpmc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.