After 10+ years having our AD setup "one way," I'm looking at the permission structure and realized that our business has in fact changed enough to where we should match our current state rather than what it was 10 years ago. With that in mind, I created a new set of groups with appropriate individuals as members. So far, so good.

Some hours passed after I added the new groups and members. I then made a new directory on our fileserver and set the new group "foo" to have "full" permissions to that directory. I'm a member of group "foo" (I'm also a member of domain and entp admin).

When I hit "apply," the directory contents disappear on me (meaning, setting group "foo" as the only group with access to the new directory). Clicking on the directory in explorer, I get "access denied." Right-clicking confirms that group "foo" has full access (which should include "me"). Checking our DC, my account is a proud member of group "foo." Connecting to all my DC's, I confirmed all have replicated this update. So, I should be able to see my directory, but I don't. As soon as I add "everyone" with full access, I see the directory contents again. Also, if I use an old established group, I can see my file directory just fine, but the new groups just don't seem to work at all.

I've tried moving the new groups into new OU's on the domain, or even into the general "users" OU. It did not seem to phase it. All DC's and fileserver are win2k3. It should not be this hard...

Any clues? I'm stumped.

Thx in advance.


You will have to log off and on again in order for the group membership changes to take effect.

  • By Golly! I thought I had logged off & on, but I guess I did not. Thx for the obvious catch! – Markus Lankeit Sep 17 '13 at 6:54
  • Lucky guess :-) – Trondh Sep 17 '13 at 6:56

Also make sure the Share Permissions on your Root Share that is being accessed is adjusted correctly. It is recommended to set permissions the following way:

Share Permissions on Root Share: Authenticated Users -> Write Permissions NTFS Permissions on Folders: Domain Local Groups (Dependent on Access rights the group should be granted)

Furthermore: Everyone access should be avoided at all ! instead try to use 'Authenticated Users'.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.