Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small domain of users that I just migrated from a linux domain running open-ldap. Our new servers are running Windows 2008 Standard. I've installed Active Directory and everything is working perfectly... except that the initial user privileges is pretty restrictive and I need to loosen it up a bit. For example once they login to their workstations, they can create new files and folders but can not modify existing files or start. I basically want to open it all up except for software installations.

Can someone please help with with this migration headache?

share|improve this question
Are the users in the domain just standard users on their PC's (not local administrators)? What OS are the clients running? What existing files are they not able to modify? What error message do they get? – Sean Earp Dec 14 '09 at 21:59
If you "open it all up" then the users will be able to instal software, too. (You can leverage excessive filesystem permissions to get "Administrator" rights...) You might as well just give them all "Administrator" rights if you're just going to let them trash the filesystem on the machines. – Evan Anderson Dec 15 '09 at 2:58
I agree with previous comments that, if you're going to "open up" the filesystem such that users can write to system directories, you might as well grant them administrator access. Also, you'd have to figure out a clean way to systematically implement this. I strongly advise against modifying the permissions of the system directories. Maybe you can expound upon your goals a bit. I hope a more targeted solution is available for your use case. – Tony Aug 8 '13 at 20:32

If they can't modify existing files then in the root of the problem files folder, select Folder Properties, Security, Advanced, confirm Local Users has FULL, check the box "Replace existing inherited permissions and apply inherited permissions from here", Apply. This will remove/fix any NTFS permission problems, assuming the parent folder has correct permissions.

Above are general steps because you don't specify the client OS. Vista/Win7 don't allow Local Users write access to many folders, Program Files, so above is meant for user profile folders only.

You can restrict software installations w/ Group Policy.

share|improve this answer
I've migrated from linux to Win2k8 standard. All the developers (domain users) are running XP SP3 and of course have full control over their machines, until I add them to the domain. Once they are using their AD logins, they are greatly restricted. I've setup the domain server strictly as DNS, WINS and AD and soon will integrate WSUS. I was a little unclear. Are you saying that the file permission problem is local to the users machine or the servers GP policy? The files they are having trouble saving / modifying are stored on their machines, not the server BTW: Thanks for your help – DevNULL Dec 15 '09 at 18:44
Yes, if the files that can't be modified are on the workstations then the permissions must be fixed on each workstation. The Default Domain GP does not restrict access like you are seeing, that isn't the problem unless you've made changes to it. Adding the Domain Account to the Local Admin Group on the wkstn can also open up things like letting users change/add printers but won't fix access to files in their domain user profile. If this doesn't fix it then post the exact error and the NTFS permissions for the file/folder. – Ed Fries Dec 15 '09 at 20:52
Here's a little more information... They can only save documents within their user folders. If a user tries to save anything in the root, system etc... directories access is denied. I logged in and gave full control to everyone within that group and still getting access errors. Any ideas. I'm sure the problem lies on the server side. – DevNULL Dec 15 '09 at 22:47
My ideas are the same as previously: set the NTFS permissions as needed (I understand you tried but if the problem remains then they aren't correct), add the Domain User to the local Admin Group, or edit your question to show the current NTFS permissions so we can see them. Changing permissions on root and system aren't recommended so placing them in the local Admin Group is the easiest solution. Understand that opens it up for them to change essentially anything. – Ed Fries Dec 16 '09 at 4:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.