0

Sorry for the horrible title.

So we have an issue, where the permissions on our file server are set as follows:

D:\Data>cacls d:\data\mydocs\johnny.depp
d:\data\mydocs\Johnny.Depp 
                           BUILTIN\Administrators:F
                           BUILTIN\Administrators:(OI)(CI)(IO)F
                           BUILTIN\Administrators:(ID)F
                           CREATOR OWNER:(OI)(CI)(IO)(ID)F
                           DOMAIN\FAccess:(OI)(CI)(ID)F

This is when a user is created and the home drive is created via ADUCs.

The administrators group is not specified on the share or the NTFS permissions of the parent folder, and inheritance is turned off. If i create a directory on the share manually:

C:\Users\Faccess>cacls d:\data\mydocs\tom.hardy
d:\data\mydocs\Tom.Hardy DOMAIN\Faccess:(ID)F
                         CREATOR OWNER:(OI)(CI)(IO)(ID)F
                         DOMAIN\Faccess:(OI)(CI)(IO)(ID)F

Which is what i expect.

So any ideas why the administrators group is being added? only thing i can think of is that ADUC is adding it, but i can't see any documentation on what permissions it uses to create the folder, i'm guessing it uses the logged in user that is creating the user, but again - no idea why that would add the permission for administrators.

Any help would be great

Improve this question
1
  • Just noticed that the Administrator account is the owner of the created directory. Not sure why. hmmm
    – selspiero
    Jul 14, 2015 at 16:25

2 Answers 2

Reset to default
1

If you pre-create & ACL the directory before assigning that UNC path to the user account, ADUC does not add the Administrators group. Any change to the user home drive path will prompt you (below) about adding an ACL for the user.

Otherwise, it creates the dir and does add the Administrators group ACL. See the following about ADUC behavior: https://support.microsoft.com/en-us/kb/817009

Therefore, the Windows 2000 Active Directory Users and Computers utility automatically defines the permissions on a new home folder for you by assigning the administrator and the owner of the home folder Full Control permission.

enter image description here

Improve this answer
1
  • Here's a PS script to change the permissions and owner of the directory after the user has been created. This will work for me. $a = Read-Host "This script will set the correct permissions for the home drive. Please enter the username" Get-ChildItem -path yourpathtomydocs\$a | Get-NTFSAccess -account BUILTIN\Administrators | Remove-NTFSAccess Add-NTFSAccess -path yourpathtomydocs\$a -Account DOMAIN\$a -AccessRights FullControl $acl = Get-Acl yourpathtomydocs\$a $acl.SetOwner([System.Security.Principal.NTAccount] “Domain\account“) Set-Acl pathtomydocs\$a $acl
    – selspiero
    Jul 14, 2015 at 20:55
0

Because you have those groups at the upper level folder and when AD creates the home folder Inheritance is turned on. It shouldn't do this. I have the same issue.

Improve this answer
1
  • thats why the above "solution" works. Its creating a folder with inheritance turned off.
    – Brad Johnson
    Apr 16, 2017 at 22:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .