When deploying our server application, on Windows Sever 2008 R2, we create a folder in "C:\Program Files" with an local administrator user and change the owner of the folder to that of a particular domain user.

When the application is running under that domain user, it is denied access when trying to create a sub folder.

My assumptions are:

  1. That in terms of ACLs, there is little to no difference between a domain user or local user being the owner of a folder.
  2. That by being the owner of a folder, they have "Creator Owner" permissions.
  3. By being "Creator Owner", they have necessary permissions to read / write permissions to a folder without needing to may any additional ACL changes.
  4. That no parent folders, i.e. "Program Files" are imposing any restrictions. After all, the user is the owner and "Creator Owner".

Since the domain user can not create sub-folders, could you please tell me what is wrong with my assumptions?


Does "Creator Owner" have modify permissions to that folder? If you look at the Effective Permissions for that user is it modify rights?

Changing the folder owner doesn't mean all your assumptions are correct. See here:


By design, the owner of the object can only configure how permissions are set, and to whom permissions are granted. By default the owner is usually automatically granted read, write, or modify permissions through some other group, but this does not need to be the case.


2) If the owner of an object changes, the permissions on the object do not change to the new owner.

Basically, your app most likely needs to grant the user additional rights to that folder they don't have simply being an Owner.

  1. If User1 and User2 both have full control on a folder, barring any other ACL or GPO configs, you are correct to assume they have the same effective access. However, the domain user and/or the application is likely passing credentials different from the folder permissions has configured. You can go to http://live.sysinternals.com and download AccessEnum and ADInsight to troubleshoot local and domain user object effective access. I'd start with ADInsight run locally to see what credentials the application is passing if it is black boxed for some reason.

  2. CREATOR OWNER in a local context is usually going to default to TrustedInstaller or a local group. Bob may have created the Accounting folder on his local machine, but Bob was only able to make that folder because he's a local admin. As a result, the owner is the %hostname%\Administrators group. Trying to call that folder remotely from a domain user account, you'll want to specify "\remotecomptuer\bob'slocalusername" credentials.

  3. CREATOR OWNER only semi-statically assigns permissions to the owner. The assignment is not changed to a new owner when one is specified. For more information, this may help: http://networkadminkb.com/KB/a80/creator-owner-explained.aspx

  4. Right-click the folder, Properties -> Security -> Advanced -> Uncheck 'Include inheritable permissions from this object's parent' -> No/Remove -> Apply/OK, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.