Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I have setup a locked down share structure. now I used this same structure on windows 2008 with no dramas and but when we came over to 2012 I have had nothing but dramas.

First I will explain some of the quarks.


User Logs into Local PC and can access folder (data\companies) but when same user then remotes into our Terminal Server which hosts these files they cant access said folder.

I have had this done in real time in front of me so chance of propagation issues or such are out. I have also gotten them to log out and back in to rule out bugged sessions.

it is only after I set them up as a direct user share to the folder instead of part of the group share dose it work on server.


User just randomly wont be able to login to folder but next day issue is gone. I did this test because I felt the permissions braking was fishy so when I saw the results of this being that it suddenly works 24hrs latter I was quite surprised. no changes on my end.

I have this feeling it has to do with the way 2012 dose permissions or that's what my gut tells me as the permissions are nice and clean based off groups. and there are no Deny groups conflicting and it is funy that it works straight away when a user is added directly to the folder. even if user was already got permission based off his group.

We did move from a 2008 server and push our AD Domain controller over to a 2012 but all things I read stated there should be no issues with this.

I really don't wish to go and do the entire permissions from scratch again as it has taken sometime to get them to the point they are so but it is getting annoying this random failure when there has been no change to warrant it.

its almost feels like AD is dying or something along those lines. if any one has any ideas that would help a lot. I will do what I can to answer any questions and quite happy to post a permissions map to show the permissions are setup in a legitimate manner

Regards Scott

share|improve this question
I doubt anybody here can give you a simple answer. I will say that NTFS permissions work the same way in W2K12 that they did in prior Windows versions (back to W2K, which introduced some differences in NTFS 3.0). I've migrated several file servers from W2K8 and W2K3 to W2K12 (W2K12R2) w/o any changes to the disks where the shared files were stored. The permissions all "just worked". Likewise, I've upgraded AD domains to W2K12 DCs without any effect on file servers or permissions. I have no doubt you're seeing problems, but they're not the result of systemic differences in how NTFS or AD works. – Evan Anderson Jun 25 '14 at 5:46
Yes it is quite strange what's happening. its as if the groups permissions are suddenly not working. I have worked with premissions a lot in the past in many companies of many sizes now this company is more a small-mid sized busness with about 30 people setup to access this server currently. so why I could understand permissions issues being a major thing with 2000 users seeing this sort of thing on 30 users is quite strange its not like I have to many shares or 99 different groups. so it has me stumped – Drake Jun 25 '14 at 6:09
The operating system version has nothing to do with your problem. Even if it seems so, you had an underlying problem that shows up late. What is the output of "dcdiag /q"? On your client, what is the output of "Test-ComputerSecureChannel"? – Daniel Jun 25 '14 at 20:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.