Environment: No Active Directory and no Domain Controller. Server is Win 2008

I have a directory with only ALLOW permissions set (no DENY permission)..and no inherited permissions. I have two groups(Administrators and CoOwners) set to Full control. However, the members of that group are not able to view/modify the folder.

If I explicitly add the 'Administrator' with full permissions, for example, then that user can access/modify fine. Why isn't giving the GROUP permission giving the members of that group the access I would expect?

Any input/suggestions are appreciated.

  • Are you testing this over the network or from an interactive logon? – Nic Jan 22 '11 at 2:12
  • 2
    In your testing, I am guessing you added users to the CoOwners group? Did you logout and login again? Groups membership is only checked when the user first logs in / connects. – Zoredache Jan 22 '11 at 2:23
  • Login/logout from what? Reboot the server(ugh) or the machine I'm trying to access from(Server or Win7 or XP)? – Russ Jan 22 '11 at 3:27
  • What are the permissions on the parent folders? Are these users or groups permitted to traverse the tree to reach the target? – John Gardeniers Jan 24 '11 at 1:57
  • Russ, can you post screenshots of your share permissions and NTFS permissions on the shared folder? (And regarding the comment by Zoredache, rebooting either the client OR server should do the trick.) – Nic Jan 24 '11 at 3:59

At a guess, I would say that group membership hasn't been established yet.

When you establish an SMB connection with a server, that's when the server determines which groups you are a part of. Changes to group membership won't take effect until the SMB connection is reset. Use the whoami tool to verify this.

> whoami /groups

You can get a list of open sessions using the Share and Storage Management administrative tool, and you can even close an SMB session right there, which makes testing much faster.

Update: It is usually a good idea to only assign permissions at the NTFS level. Try changing your share permissions to allow "Full Control" for "Everyone" to eliminate one possible cause.

| improve this answer | |
  • When I run whoami /groups, it says my ID (I am logged in as 'Administrator') is in a bunch of groups including 'Administrators'. What are you suggesting I try to verify I my credentials are correct? thanks. – Russ Jan 22 '11 at 3:20
  • If you've set up the ACL on your shared folder so that "CoOwners" has full control, then you want to make sure that "CoOwners" also appears in whoami. – Nic Jan 24 '11 at 4:02

Because in a GPO ( wheter have AD or not, windows O.S.s have GPOs ;) ) top-level permissions always overrides lover levels. And if there is no specific policy, the behaviour will be "Always Deny". In ths case when you explicitly add "Administrator" whis is a user, overrides the policy for "Administrators" which is a group and voila, you get your permissions. When you dont add, group policy grants that permission but default user permission ( for admin e.g ) overrides and denies it... BUT, when you give "Ownership"... This is what you need :) It always overrides defaults ;) ( and of course unless you explicitly add any user ;) as i mentioned above top-level policies ALWAYS overrides lover level policies ;) )

| improve this answer | |
  • 1
    Less emoticons and more answer in the future. – ErnieTheGeek Jan 22 '11 at 2:31
  • I'm sorry, this is incorrect. Not all operating systems have group policy; maybe you're thinking of ACLs? Top level permissions will apply to the descendents when inheritance is enabled, but they never "override" lower levels. – Nic Jan 22 '11 at 2:32
  • i was talking about windows operating systems.was i wrong?actually,yes,sorry,advanced security options came with ntfs and my assumption covers win2k and after.and by top-level,i must be wrote upside-down,i was mentioning not base but derived policies.like if a "group" policy is low-level,a "user" policy will be top-level (and this should be reversed if i'm wrong).so if there is no ownership and no specific permission,the policy will be defaultly 'deny' right?so this is my base (low level).and if i enter a user right (this is my top level) it overrides base and runs the actual user right,right? – The_aLiEn Jan 22 '11 at 2:40
  • I am using Win Server 2008. I wonder if there is any conflict between 'Permissions' and 'Sharing options'. Both are only trying to give access to the folder to Administrators and CoOwners. Note that I am accessing the WinServer2008 shared folder from the WinServer2008 machine, a Win7 machine, and an XP machine. – Russ Jan 22 '11 at 3:24
  • Not a clear answer, though I do like the idea of "lover-level policies". @ErnieTheGeek, you mean "fewer emoticons", not "less emoticons". ;) – hmallett Jan 22 '11 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.