Why Explorer ask me take control of the folder?

Question

I'm logged as domain admin on Windows Server 2016 (server member of my domain). I create a second NTFS partition (e:) and I remove access to the local users group (I dont want non-domain admin access to e:). I create a folder test at the root of e:

test inherit ACL from the parent (e:).

From Explorer.exe, directly on the server, when I try to enter on test, I get a security popup. If I accept: a new ACE is created with my account on test. I discarded. I don't have problem with the local administrator account.

PS E:\> (Get-Acl e:\).Access


FileSystemRights  : ReadAndExecute, Synchronize
AccessControlType : Allow
IdentityReference : Tout le monde
IsInherited       : False
InheritanceFlags  : None
PropagationFlags  : None

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : CREATEUR PROPRIETAIRE
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : InheritOnly

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : AUTORITE NT\Système
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrateurs
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None

PS E:\> (Get-Acl e:\test).Access


FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrateurs
IsInherited       : True
InheritanceFlags  : None
PropagationFlags  : None

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : CREATEUR PROPRIETAIRE
IsInherited       : True
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : InheritOnly

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : AUTORITE NT\Système
IsInherited       : True
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrateurs
IsInherited       : True
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : InheritOnly

PS E:\> Get-LocalGroupMember administrateurs

ObjectClass Name                           PrincipalSource
----------- ----                           ---------------
Groupe      ADM\Admins du domaine          ActiveDirectory
Utilisateur FILESERVER\Administrateur      Local

PS E:\> Get-ADPrincipalGroupMembership $env:username|? name -eq 'admins du domaine'

distinguishedName : CN=Admins du domaine,CN=Users,DC=adm,DC=sb1
GroupCategory     : Security
GroupScope        : Global
name              : Admins du domaine
objectClass       : group
objectGUID        : 700378f7-5025-4e24-b293-343ba0f7fcf6
SamAccountName    : Admins du domaine
SID               : S-1-5-21-2142639626-767165437-316617838-512

If I don't remove access to local users group at e:, I don't get prompted to access to test cause the ACE with my name is created automatically.

The effective access tab show my account have full control, inherited from parent folder, to the local administrators group.

From another computer on the domain, with my domain admin account, i can access without security popup to \\fileserver\e$\test (without ACE of my name).

The question is, how every domain admins can access files locally, without create individual ACE for every domain admins account ?

Answer 1

User Account Control restricts Explorer's ability to make direct use of the user's membership of certain groups, including the Administrators local group and the Domain Admins global group.

However, this restriction only applies to certain special groups, and in particular it does not apply to groups that contain those groups. This means that you can resolve your problem by creating a global group in the domain called, say, "My Domain Admins" and add the Domain Admins group as a member of My Domain Admins.

If you then grant My Domain Admins full permission to the E drive, all members of the Domain Admins group will be have full access to that drive when logged in locally.