I think I'm having some difficulty understanding NTFS permissions. My understanding is that when possible you want to avoid assigning a specific user account to NTFS and instead use a group. So I set up a folder with the owner as the administrators group. I removed all user accounts on the folder and added the administrators group with full control.

I'm logged into the computer as user that belongs to the administrators group. But when I open the security properties on the folder is says, "you must have read permissions to view the properties of this object." I can click Advanced and Continue and edit the properties, but unless I specifically add my user account to the permissions or make my user account the owner, I get the above message. Yet my account is part of the administrators group. Shouldn't those permissions propogate? Why would I have to assign my user account specifically, when I've assigned a group that my account belongs to? Thanks!

  • 2
    Do you have User Account Control enabled on the client computer where you were testing? UAC strips your "Administrators" group membership. Jul 22 '14 at 15:26
  • Turned off UAC, rebooted, still no go.
    – skinneejoe
    Jul 22 '14 at 15:54
  • Have you tried using the Effective Permissions tab to see what permissions your user account has been granted?
    – dbr
    Jul 22 '14 at 16:34
  • Yes, and it says my account has full control. It seems like this behavior is by design, which is disappointing.
    – skinneejoe
    Jul 22 '14 at 19:16
  • 4 years later, this is still valid question. Maybe it is by design, but I don't understand the logic. User in a security group with full control should be able to see without having to explicitly be added as a user. Oct 4 '18 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.