Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On server1 I have E:\data\ that contains the home folders and shared department folders in it. Everyone has full share rights, then the rights are restricted appropriately through NTFS permissions.

When I connect to the share \\server1\data\ from a test user, everything works correctly and shows up as it should.

So then I set up a replication group to replicate E:\data from server1 to server2 E:\data. I wait about 10 minutes or so and see that everything has been replicated correctly. E:\data on server2 has everything, and the NTFS permissions are there. So it's copying the NTFS permissions from server1 correctly, or so it appears.

I then share server2 E:\data - the same way I did with server1 - everyone has full control. With the NTFS permissions restricting what they can see.

The problem is that when the same test user, connects to the share \\server2\data, for some reason the test user can see and has full rights to everything... even though I verified that E:\data on server2 has the correct NTFS permissions, replicated from server1.

So basically, on the second server, even though it appears everything is replicating correctly, the permissions aren't working. It's like they're there but aren't being used somehow?

Here is a screenshot of a folder where the user shouldn't have access: enter image description here

share|improve this question
    
What version of Windows on the file servers? –  pauska Feb 6 at 13:49
    
This is a server 2012 test environment. –  Jeremy Feb 6 at 14:03

1 Answer 1

up vote 3 down vote accepted

I'm suspecting that you don't have Access-Based Enumeration enabled on the secondary server, and this gives you the notion of the users having full access to everything. DFS-R does replicate the NTFS settings over (unless you muck around with NTFS settings on the primary folder BEFORE syncing).

ABE is something you normally only configure on the DFS share, as users are pointed against those instead of directly accessing a server.

Please check the following setting: enter image description here

EDIT after a longer comment discussion below

The local Users group have access to the folder, which also grants "Domain Users" access to it (they're joined).

share|improve this answer
    
ABE is enabled for the entire namespace through the DFS Management utility, but I also went to the share on server2 and enabled ABE there as well. Seemed to have no affect. But also, it's not just that they can see everything. This test user should have 0 rights to a certain folder, but I can rename it, delete it, create new things inside of it... –  Jeremy Feb 6 at 14:01
    
@Jeremy are you using creator owner on these shares? If so, check the owner of the folder(s) –  pauska Feb 6 at 14:08
    
the creator owner permission is still in there yes, I didn't remove it. But I verified that the owner on all of these folders is the local server1\administrator account. –  Jeremy Feb 6 at 14:13
    
@Jeremy this really doesn't make any sense.. can you provide a screenshot of the advanced NTFS rights on one of the folders where the user shouldn't have access? –  pauska Feb 6 at 15:25
1  
@Jeremy Domain Users is a member of the local "Users" group on domain-joined clients/servers. Same goes for the Administrators group. –  pauska Feb 6 at 17:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.