Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a bit stumpped on this one.

I created a security group in AD called "special data users" and add myself to it.

I then created a share on a server and give that AD security group full access to the share.

If i try to access the share I cannot and get a permission denied error.

If i add my user account directly to the share or add a different security group that's been around for years that I'm a member of it works fine.

Any tips or suggestions on what to look for why this new group doesn't work would be appreciated. I've looked high and low and can't figure out why any new security group created doesn't work...


share|improve this question

When you added yourself to the group, did you log out of your workstation and log back in? Security Group membership is a component of the access token granted to your user ID at logon and changing group membership requires a log out and log in order to get a new access token that reflects the new membership.

share|improve this answer
Tks man! Didn't know that... After 1 hour digging around, I found this post, and solved my problem! – Pascal Oct 19 '11 at 15:42

Make sure that you've assigned read permissions to that "Special Data User" both on Security tab and in Sharing -> Permissions.

Also you need to re-login once you added user to a new group.

share|improve this answer

I'm not sure this would be your problem, but I've been burnt by it in the past. How many groups (including nested groups) is your account a member of? You may have just passed an AD limitation. There is a limitation on group memberships due to the Kerberos ticket size in AD. Here's more reading from Technet on some AD limitations. Check out info under the Group Memberships for Security Principals heading.

To check if this might be the case, create a new account and add it to your new group and see if that account can access the share.

share|improve this answer

What type of Group have you created? It does make a difference if they are Domain Local, Global or Universal.

share|improve this answer
It is a global security group – AlanBarber Sep 24 '09 at 14:39
Try it as a Universal security hgroup and see if that works. – Tubs Sep 28 '09 at 13:15

I recommend you setup share permissions as follows to avoid confusion:

On the share permissions themselves:

DOMAIN ADMINS = Full Control

Everyone= Write/Read

Then on the NTFS security permissions:


and then set the NTFS security for others based on need.

By doing that you will avoid problems with share permissions overriding NTFS permissions.

share|improve this answer
It would be better to use "Authenticated Users" instaed of "Everyone". – Tubs Sep 24 '09 at 14:36
@Tubs - It's theoretically the same thing ever since XP and 2003...see here: – TheCleaner Sep 24 '09 at 14:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.