1

I have a problem with a Win 2016 Server. There is a folder which all Users of an AD-Group can access. Inside there is a folder which not all users are supposed to get access to.

I have the following groups set up in my AD:

  • GroupA (Global, Security)
    • Includes Users U1-U5
  • GroupB (Global, Security)
    • Includes just Users U1-U3

Now on to the folders:

  • FolderUpper
    • GroupA is allowed to: change, read (execute), show content, read, write
  • FolderInner (lies inside FolderUpper)
    • GroupA can do the same here obviously
    • GroupB is set to Deny (FullAccess)

But users in GroupB can still access the folder. Any idea why this is the case? Those users are in both GroupA and GroupB. One allows access one denys access and I thought deny > access so I don't understand why the still get access.

when I set the unser to deny idividually the are no longer allowed in but it's a pain to deny every single user so working with a group that is set to deny would be ideal.

regards

3
  • Are you sure the server is aware of those users' group memberships? Were they added just today, after the users already got their Kerberos tickets for the day? Jan 29, 2021 at 10:43
  • GroupB was added today, one user in GroupB was also added today. The rest of the users in GroupB already existed for a few years now. I ran a gpupdate /force from an elevated prompt as well but doesn't make a difference.
    – Alkahna
    Jan 29, 2021 at 10:54
  • I meant added to the group. The user's existence doesn't matter; but the user's group memberships are remembered at login time and not re-checked on each access. (And gpupdate has nothing to do with groups at all...) Jan 29, 2021 at 11:05

1 Answer 1

1

The users must logoff and logon again from their workstations before the group membership is effective, because group membership is retrieved from the Kerberos token which is acquired while logging in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .