Currently I have setup a locked down share structure. now I used this same structure on windows 2008 with no dramas and but when we came over to 2012 I have had nothing but dramas.
First I will explain some of the quarks.
User Logs into Local PC and can access folder (data\companies) but when same user then remotes into our Terminal Server which hosts these files they cant access said folder.
I have had this done in real time in front of me so chance of propagation issues or such are out. I have also gotten them to log out and back in to rule out bugged sessions.
it is only after I set them up as a direct user share to the folder instead of part of the group share dose it work on server.
User just randomly wont be able to login to folder but next day issue is gone. I did this test because I felt the permissions braking was fishy so when I saw the results of this being that it suddenly works 24hrs latter I was quite surprised. no changes on my end.
I have this feeling it has to do with the way 2012 dose permissions or that's what my gut tells me as the permissions are nice and clean based off groups. and there are no Deny groups conflicting and it is funy that it works straight away when a user is added directly to the folder. even if user was already got permission based off his group.
We did move from a 2008 server and push our AD Domain controller over to a 2012 but all things I read stated there should be no issues with this.
I really don't wish to go and do the entire permissions from scratch again as it has taken sometime to get them to the point they are so but it is getting annoying this random failure when there has been no change to warrant it.
its almost feels like AD is dying or something along those lines. if any one has any ideas that would help a lot. I will do what I can to answer any questions and quite happy to post a permissions map to show the permissions are setup in a legitimate manner