I have a file share set up on a Windows Server 2008 R2 server I have a security group called "Allow file access" (not its real name!) which include a bunch of users and also "Domain Admins"

I have a single permission set up on the share to grant read/write access to "Allow file access" group. And also the security settings for the folder grant full control to "Allow file acess" ND Domain Admins

However, when logged on (as a Domain Admin) I get a Permission Denied error when trying to access the share.

If I explicitly add "Domain Admins" to the list of share permissions I am allowed access.

Am I not allowed to nest Domain Admins in other groups?

  • 4
    Have you logged out and then back in with your domain admin account after adding Domain admins to the other security group? – MDMarra Oct 30 '13 at 17:54

Log out and back in again to get the new security token.

(FYI, I tested your exact scenario and this was the issue for me, so I'm betting same for you)

  • Thanks, that has done the trick - is there a KB/Technet article that explains why you need to do that? – Phil Oct 30 '13 at 22:49
  • 1
    Phil, I don't recall where the KB article is, but here's this if it helps: timstechnoblog.blogspot.com/2012/07/… – TheCleaner Oct 31 '13 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.