Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set permissions on particular folders within our domain (Windows 2003). NTFS permissions are set on the folder, to enable a certain group, call them Helpdesk, to change permissions. Domain Admins have permission already. Access to the folder I've checked are the following: On the server, via Explorer ie. e:\Folder\Shared-Folder through network share ie. \\servername\Shared-Folder through DFS ie. \\domain\namespace\Shared-Folder

Domain admins have access to everything, can change everything

if helpdesk log into server, and go via Explorer, they can make changes. if they connect via DFS, they can see the Security Tab, but all the "add" and "remove" buttons are greyed out. I think it's because they don't have "Delegate Authority" in DFS however if they go via the network share, they same thing happens.

I checked the Share permissions and this is where is gets a bit weird. The Share permissions are set to: Everyone - Read, Write

but if I log in as an admin account, I get full control, despite the share permissions.

can anyone help me with this odd problem? do DFS permissions trump share permissions?

share|improve this question

If you log into the server then you aren't accessing it through a share. You're just hitting the NTFS security directly, share perms have no effect.

share|improve this answer

You may want to try giving the Helpdesk group share permissions directly, to see if that makes a difference. Also, the Effective Permissions tool in W2k8 is useful to see the resultant set of permissions for a given security group on the folder.

share|improve this answer

Share permissions is different / complementary to security permissions. You know that right? That the security permissions need to be set to allow access as well as the share permissions.

Probably obvious...

share|improve this answer

Try full control on the share permissions?

share|improve this answer
but that doesn't explain why the domain admins are able to do everything, even when they have no access according to the share permissions. Full control on the users does seem to give them access, but I'm perplexed by the share permission inconsistencies. – Jonathan Houston Sep 8 '09 at 17:01
Hmmm ... difficult to troubleshoot without seeing screenshots of all the file share/NTFS security settings of the shares/files. – James Risto Sep 10 '09 at 12:08
Except if the Everyone RW permission somehow does not apply to the Helpdesk group, then you would see something similar. Can you elaborate on the scopes of the different groups; ie Domain Local, Global, Universal? – tplive Oct 17 '09 at 8:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.