We have a very small LAN here, but some peolpe here think we need Active Directory, though nobody knows how to maintain it.

I am not in the position to change this.

How can I get full access (on Linux it would be "execute" rights) also for files on network drives (the files are just on another machine next room)

My account is in the group Administrators on a windows 2003 server Domain Controller.

I cannot open simple MS Access 2000 Databases or CHM Files from network drives in the lan

How to do that? Some policy setting? I want to change that once. It is useless. We have no distinction between local or network files here. I would have to copy everything to a local drive and then do what I want.

Edit: When i doublecklick an MS Access file the following happens:

First there is a security popup from windows 2003, askig me if I really want to open this file and telling me that files from the INTERNET are dangerous.

This is strange, because it is not thge internet, it is the intranet.

I accept and then MS Access loads, and displays the program window with all the toolbars, but not the database. Then appears an application-modal message box in the center of the screen on top that says more or less:

I cannot iopen this file, it is outside the intranet. Some files on the internet are dangerous. If you want to oen it you have to copy it to the intranet.

So I have to teach the Domain that the local drives are Intranet?


You need to add your Active Directory domain to the "Local intranet" zone in Internet Explorer. This should eliminate the warning about files from the Internet.


  1. On your computer (not the DC), open Internet Options (within Internet Explorer or from Control Panel).
  2. Click the Security tab.
  3. Click the Sites button.
  4. Click Advanced.
  5. Add your Active Directory domain (the fully-qualified domain name) to the list. (For example, if your AD domain is mydomain.mycompany.local, you would type that whole thing into the box.)
  6. Click Close.
  7. Click OK.
  8. Click OK.

If you need to do this for a bunch of computers, you may want to use Group Policy, Group Policy Preferences, or a logon script using reg.exe to set the appropriate registry key as follows.

Under the key, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains, create a key with the name of the fully-qualified Active Directory domain. Within that new key, create a value with the name *, with type REG_DWORD, and with value 1. Following the example above, the key you create would be named mydomain.mycompany.local, and you would create a REG_DWORD value named * with a value of 1.

Note: These instructions were based on Windows XP and Internet Explorer 7. Newer versions may have changed functionality, labeling, and navigation.

See Internet Explorer security zones registry entries for advanced users on the Microsoft Support site for more information.


Believe it or not, this actually is an IE thing.

Full details here: http://support.microsoft.com/kb/896358.


If you are in the Domain Admins group that should pretty much be all you need. Keep in mind that Deny ACL's take precedence over Allow ACL's so if you are explicitly denied access it will deny you. As a domain admin, you generally have the power to change permissions to give you access to something.

  • i have no deeper active directory knowledge. can you tell me how to be able to execute those files? what do i do? – user12096 Apr 9 '10 at 20:44
  • my account is in adminsitrators and domain administrators group. what is it that forbids me to execute an mdb on a local network share? – user12096 Apr 9 '10 at 20:45
  • Please clarify by giving the error message you receive when trying to execute/open the file. – sinping Apr 9 '10 at 20:47
  • theyare localized, i will try and translate, i put it into the question in 2 minutes – user12096 Apr 9 '10 at 20:48
  • What if you use File, Open from within Access? You can fix the security warning by adding the server name and/or IP address to your list of Local Intranet sites within Internet Options. Most likely 'automatically detect' isn't selected within there. There is an Execute permission within Windows, but it's typically not used as it's generally combined with the Read permission. In your case, you aren't executing the file anyways, you execute Access which opens the file in question. – sinping Apr 9 '10 at 20:58

Word of advice: take your user out of the Domain Admins group. You don't do your day-to-day work running as the root account in Linux, do you?

  • ok, i removed the user from the AD admin group. (though it seems another level of overkill in this special LAN - no need for AD - no need for separate security levels, makes everything even more complicated.) – user12096 Apr 22 '10 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.