From a security and manageability standpoint, the best solution is to find who is denying rightful access and make them stop.
Users and lower-tier administrators should not be allowed to interfere with your ability to monitor and manage the IT infrastructure.
If you are only allowed to address the technical problem without addressing the larger issue, you will be forced to implement technical measures.
If you are only allowed to restore access (and not worried about identifying the source of the change), you need to do two things:
1. Assign proper NTFS permissions
You can do this via script with the icacls /grant command, or you can do it via the Group Policy editor. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > File System.
If you do it via script, you can also distribute that script as a Logon/Logoff/Startup/Shutdown script via Group Policy.
2. Assign proper SMB permissions
This requires the net command with the share verb. E.g.:
net share SHARENAME /grant:GROUPNAME,PERMISSION
GROUPNAME needs to be quoted if it contains spaces, such as "DOMAIN\Domain Admins", and PERMISSION should be READ, WRITE, or FULL.
Note that Startup and Shutdown scripts run as SYSTEM by default, so they should have no problems setting the desired permissions regardless of what has been configured for the domain admins and local admins.
If your users get clever in the future, they may add a DENY ALL entry that applies to the "Domain Admins" group. The explicit DENY entry takes precedence over your GRANT entry. You can remove this ACL entry via script as well, so it is easily defeated.
If they turn it into an arms race, you can win as long as the machine is joined to the domain, but it wastes time on both sides. This is why it is better to fix the problem via education/enforcement rather than technical countermeasures.