I've run into a rather interesting issue when playing with one of my domain labs.
There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. The directory has the following permissions set:
- FILESERVER\Administrators: Allow full control to the directory, subdirectories, and files
- DOMAIN\Domain Admins: Allow full control to the directory, subdirectories, and files
- Authenticated Users: Allow create files, create folders, write attributes, and write extended attributes to the top directory only
In addition, the directory is also a network share with "Allow full control" to the Authenticated Users group.
When user john.doe, a member of the domain admins group, tries to access the directory from the fileserver, he gets the error "You don't currently have permission to access this folder". Trying to access the network share from the same server also results in a permission denied error (although the user can still access his own directory within the share).
Accessing the share from another computer logged on as the same user allows access as configured.
The only way you can access the files in the directory while logged on to the file server is by opening an elevated command prompt. UAC is disabled for all computers in the domain through Group Policy (Run all administrators in Admin Approval mode enabled, and default behavior set to elevate without prompting).
All roads point to the user being allowed access, but it's still being denied. Any ideas?