We have a Windows 2003 single domain.
A share located on a server has full rights for every authenticated users.
Under this share, a folder is read-only for everyone (except buitlin\Administrators group).
Everything work as intended.

I discovered one user who, from his Windows 7 pro workstation, has full access on this folder. He can do whatever he wants. If he log on another computer, he has read-only access.
When I display effective rights for this user FROM his workstation, I see he has every boxes checked. When I display the same thing from the server, I see correct rights.

This user belong to the builtin\Administrator group of his computer (we have to. You know, some software are very very bad).

Any idea about the fact this user has full rights only from his workstation ?

screenshots of various security settings

  • Which "Administrators"-group? Builtin\Administrators? Pleases clarify both administrators groups.
    – Tom
    Feb 14, 2012 at 12:24
  • Please upload a screenshot of the NTFS and Share permissions for the folder in question.
    – Dan
    Feb 14, 2012 at 12:33
  • Done. I don't think this will help. Feb 14, 2012 at 13:28
  • What domain groups is this user a member?
    – gWaldo
    Feb 14, 2012 at 13:32
  • This user is not a member of any domain groups. Feb 14, 2012 at 16:56

2 Answers 2


The fact that the user only gets this extra access from a single workstation, and doesn't get it from any other is an interesting diagnostic. It tells me that there is something up with that workstation that is causing this to happen.

One check that is worth doing is verifying what user he is logging in as. You can do this from the Current Sessions listing in Computer Manager. It may take some work, but verify he is logging in as himself. If that doesn't work, have him create a file on that share and check to see who owns it. This should shed some light on the problem.

If it turns out he's logging in as the wrong user somehow, it could be that his workstation isn't actually domained and there is a misalignment on the username translation. On the 2003 server's security settings, the 'share model' may be set to allow unknown users to emulate a specific user.

  • I just tested the same user on another workstation: everythink is normal. The user can't write the protected files. So the problem real seem to come from the initial workstation. I will run your suggested test tomorow, when I could access this computer again. Feb 16, 2012 at 11:38
  • I did the test as you suggested: create a file from the faulty workstation and... well, today everything is normal. The user can no longer write where he mustn't. So I don't know what was wrong. Feb 24, 2012 at 9:16

It looks like someone gave him local admin privileges on his workstation. Right click on My Computer > Manage > Local Users and Groups, you can check there to see who's under the Administrators group.

  • This user is local admin of his own workstation. This is stated in the question. But this don't explain why the problem exist. Other users are local admin too, without this problem. Feb 14, 2012 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .