I have a problem with a Win 2016 Server. There is a folder which all Users of an AD-Group can access. Inside there is a folder which not all users are supposed to get access to.
I have the following groups set up in my AD:
- GroupA (Global, Security)
- Includes Users U1-U5
- GroupB (Global, Security)
- Includes just Users U1-U3
Now on to the folders:
- FolderUpper
- GroupA is allowed to: change, read (execute), show content, read, write
- FolderInner (lies inside FolderUpper)
- GroupA can do the same here obviously
- GroupB is set to Deny (FullAccess)
But users in GroupB can still access the folder. Any idea why this is the case? Those users are in both GroupA and GroupB. One allows access one denys access and I thought deny > access so I don't understand why the still get access.
when I set the unser to deny idividually the are no longer allowed in but it's a pain to deny every single user so working with a group that is set to deny would be ideal.
regards