I have a network of 4 VMs using Active Directory in a local domain: 2 DCs using Windows Server 2008 R2 Enterprise, 1 Member Server using Windows Server 2008 R2 Enterprise and one Client using Windows 7 Ultimate. I shared a folder on the member server containing a text document. The Sharing Permissions are set to Full Control for Everybody. I mapped a network drive on the Windows 7 client with the shared folder from the member server using as credentials a user who is not from the Administrators group, but who is a member of the "Sales" group to whom I give all NTFS Permissions except Full Control & Modify. All is fine and I can open the folder and view it's contents. But if I remove the "Sales" group from the list of groups specified in the NTFS Permissions for the shared folder, I still have access to the folder using the same user credentials to map the network drive.

Why doesn't the implicit denial kick in?

If I try to access the folder before giving NTFS Permissions to the "Sales" group, I can't access it, so at first the implicit denial does kick in. It's like after I remove the "Sales" group from the NTFS Permissions, the setting is still somewhere in the memory, even after I restart the member server containing the folder.

So why at first the implicit denial works and after the user's group had NTFS Permissions access, the implicit denial doesn't work anymore?

I searched the web about this problem and there's no much info or problems reported to implicit denial.

Thank you!

  • The problem was because of some nested groups. Topic closed. – user2119805 Aug 27 '17 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.