I am not sure if this is normal or not, however it seems network shares on our domain are given full access to users that are admins on their local machine if the server\Administrators security permissions is set.

Is this standard? It poses a fair few issues for setting up permissions as my predecessor has set all sorts of local privileges on computers throughout the domain. Unfortunately I can't change this with GP at this stage as I am unsure of the ramifications to our users by forcing this.

Obviously I can just remove the server\administrator security group from all shared folders but this would be a massive task.

Has anyone come across this issue before? The only reason I picked up on it was I was setting up a DFS and one of my users had full access no matter what permissions I set (Unless I removed the changed the server\administrator permissions to domain\domainadmin)

  • forget the share permissions they should be set to domain users full probably , set the permission at the ntfs level. I think your confused about this somewhat.
    – tony roth
    Jun 21, 2011 at 3:59

1 Answer 1


It probably sounds like the users are added to the administrator security group in ADUC.

  • This is not the case, I created a new user, added them as a local admin on a computer and logged in to a network share with only server\admin permissions. This user had full access but once I removed the user from the local admin acccount on this computer this went away to read only.
    – Daniel
    Jun 22, 2011 at 21:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .