I have a user (dAdmin) and that user is a member of the domain admin's group and is also a member of the local server's (serverA) Administrators group.

On the folder (fShare) I set it up as a share in a cluster. I give FULL rights to the domain admins group and the local server's (serverA) group called Administrators.

For some reason when I try to access the folder as the current user (dAdmin) I get access denied! I can click the OK button on get perm access and get in just fine. When I do that though it adds my user account (dAdmin) to the ACLs!!!

enter image description here

What's the point of groups if Windows will not use them? I have a user added to a group, that group has full access to the folder, then bam! Access Denied!!!

Why does this happen? Why can't I rely on the groups for access instead of the individual user accounts??


  • possible typo, 3rd para (sAdmin) maybe should be (dAdmin)? – gwillie Aug 14 '15 at 3:13
  • 2
    It's a sort of easter egg from microsoft telling you why you shouldn't be using windows – gwillie Aug 14 '15 at 3:14
  • 1
    In the past setting group permissions in AD, sometimes the user had to log out out and in again for some group settings to be applied, as certain AD settings are only applied on login. Though your situation sounds different there may be some connection – gwillie Aug 14 '15 at 3:35
  • @gwillie - Tried that first thing because that's exactly what happens. The GP only applies when a user logs on. So if you add a user to a group after they are logged on it will have NO effect until they refresh their policies via "gpupdate /force" or logoff then back on. But that was not the problem. I added the user to the group long ago with many logons since. But... Just for the heck of it I went ahead and REBOOTED altogether just to rule out anything I forgot about. – Arvo Bowen Aug 14 '15 at 14:31
  • I think it has to do with the new way Administrator privileges are handled. Kind of like when you run a program even though you're an Administrator you run it WITHOUT Admin privileges. Though you can right click and "Run as Administrator". Maybe even though I'm a member of the admin group I do not have those rights. I guess it's time to create a NEW security group in my domain and deal with rights that way instead of depending on the Administrators group by default. ;) – Arvo Bowen Aug 14 '15 at 14:34

There is a tool called BeOwner that can take ownership to all folders and files at once:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.