Sorry for the horrible title.
So we have an issue, where the permissions on our file server are set as follows:
D:\Data>cacls d:\data\mydocs\johnny.depp
d:\data\mydocs\Johnny.Depp
BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F
BUILTIN\Administrators:(ID)F
CREATOR OWNER:(OI)(CI)(IO)(ID)F
DOMAIN\FAccess:(OI)(CI)(ID)F
This is when a user is created and the home drive is created via ADUCs.
The administrators group is not specified on the share or the NTFS permissions of the parent folder, and inheritance is turned off. If i create a directory on the share manually:
C:\Users\Faccess>cacls d:\data\mydocs\tom.hardy
d:\data\mydocs\Tom.Hardy DOMAIN\Faccess:(ID)F
CREATOR OWNER:(OI)(CI)(IO)(ID)F
DOMAIN\Faccess:(OI)(CI)(IO)(ID)F
Which is what i expect.
So any ideas why the administrators group is being added? only thing i can think of is that ADUC is adding it, but i can't see any documentation on what permissions it uses to create the folder, i'm guessing it uses the logged in user that is creating the user, but again - no idea why that would add the permission for administrators.
Any help would be great