I'm looking for a way to centrally grant access to the c$ share of all our PCs to our IT active directory security group. They often use this to check desktop shortcuts, etc. Right now they have to use a domain admin credential each time they access a c drive.

Can I do this on a Windows 2003 Server domain controller running AD? How?

  • What OS are you using on your workstations? – Zoredache Apr 18 '13 at 18:35
  • @Zoredache -Primarily Windows XP, with an increasing number of Win7 boxes. – MAW74656 Apr 18 '13 at 20:29
  • @MAW74656 any updates? i need to achieve the same result... i need to figure out how to that, but for a single user... – Leonardo Dec 9 '15 at 17:12

Havenard is right in that you probably shouldn't modify the NTFS permissions on the C: drive. What you can do is to use Restricted Groups in Group Policy to add the security group in question to the local Administrators group. That will give them the access they need to the C: drive.

  • Ok, so use a group policy restricted group. Where would I apply this policy? To the PC's in the domain, or to the user's I want to grant the access? – MAW74656 Apr 18 '13 at 17:27
  • 2
    Restricted Groups is a Computer setting so you need to apply the GPO to the Computers. – joeqwerty Apr 18 '13 at 17:28

System's network shares like C$ and ADMIN$ should not be touched. Any changes will most likely be lost upon boot anyway.

If you want a user or a group to have access to your entire C driver, then create a new network share, name it "C" or whatever you want and share it with this group. Leave C$ alone.

  • I don't think this is correct, as c$ gives acccess to the C drive, through which you can browse to the users desktop or My Documents folders. Changes DO keep through reboot. – MAW74656 Apr 18 '13 at 17:16
  • 1
    @MAW74656 "Hidden administrative shares that are created by the computer (such as ADMIN$ and C$) can be deleted, but the computer re-creates them after you stop and restart the Server service or restart your computer" -- Don't try to alter the permissions on these admin shares. Either add your IT group to the local admins group or create a new share of C: and add the appropriate permissions. – jscott Apr 18 '13 at 17:23
  • 2
    @MAW74656 Your Domain Admin is a member of the Local Administrators group on all computers by virtue of the computers being a domain member. – jscott Apr 18 '13 at 17:26
  • 1
    Only members of the computer's local Administrators group will have access to the C$ and Admin$ shares -- this includes Domain Admins. Add the required domain groups to the local Administrators group on these computers and those groups will also have access. – jscott Apr 18 '13 at 17:30
  • 1
    @MAW74656 There are many, centrally managed, ways to alter group memberships for domain-joined computers. See Joe's answer for one example using Restricted Groups. – jscott Apr 18 '13 at 17:33

From the sounds of the question you must be new at this stuff, anyway create a group for these IT people put them in it then add this group to the local administrators group. This is not ideal, ideal would be to create a seperate account for each of these it people and to place that account in the IT Group and tell them not to use that account unless absolutely necessary. Unfortunately this may be over you head in terms of understanding this.

  • So your answer to my question is "you can't do that centrally". And I do NOT appreciate the rudeness. – MAW74656 Apr 18 '13 at 17:14
  • 1
    yes you can do it centrally its called group enforcement via gpo's. – tony roth Apr 18 '13 at 17:57
  • THAT should have been your answer. – MAW74656 Apr 18 '13 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.