We have a Windows Server 2008 SP2 Standard 64-bit operating independently in workgroup mode, without Active Directory installed.
We want only members of the group "Administrators" have access to the partition D, so we changed the security permissions on this drive; now there are only three rules in the information security: the built-in group "Administrators" with full access to folder, subfolders and files, the built-in group "System", with full access to folder, subfolders and files, and the built-in group "Creator Owner" with full access to the subfolders and files. The owner of the D drive is also the group "Administrators". UAC is enabled for all users.
When we try to access the drive D, using an account of the group "Administrators", we received an access error and a message "Access Denied". The only way to access is to disable UAC for members of the group "Administrators", but we prefer to use UAC on the system for all users. Another way is to give access rights to each member of the group "Administrators" individually, but this is not a good solution.
We realize that giving access to other groups such as the built-in group "Everyone", solves the problem, but obviously we did not want to give everyone access to this unit. We thought if we gave a group of users full access to a resource, we were giving full access to all group members, but it seems that UAC is interfering with this basic behavior of the system.
Anybody know how to set permissions to give access only to members of the group "Administrators", without disabling UAC for the group "Administrators" or completely, and without giving permissions to each group member individually?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Nothing new on this article. As I say in the question, we already know that disabling UAC or using Admin Approval mode, "solves" the problem.
The question is: is this the only way to do it?; if it's true then we're talking about a bug, not an operating system behaviour, because when I'm trying to access to unit D I getting an error message, not a prompt from the UAC. I think that this is permissions related problem, more than UAC problem.
Any other ideas?
Thanks.
How did you remove the permissions from the other users - I assume that you did not fall into the trap of using the DENY option to any of the other groups - if you have for example denied EVERYONE then admins are also members of Everyone - hence the problem - Remove the groups from the ACL rather than using DENY.
Well, it's not the only way.
UAC strips the Administrators group from your security token, and the NTFS security dialog is obviously not UAC aware (no, I don't know whether it's a bug or by design). In other words: the membership in the Administrators group doesn't help you any as long as you're not working with elevated privileges.
The easiest solution to resolve this: create a domain local group "NTFS-DDrive-Full" or whatever; in addition to Administrators and System, give this group Full Control permissions on the drive. Add the admin users (or a global group containing these users - other than domain admins...) to this group, and you should be able to fully administer the file system.
Note that the "Creator Owner" special group does NOT "have" any permissions as such, you don't need it to give the Administrators access just because they're the owners. This group is only a placeholder; if a file or folder is created, an explicit ACE for the owner of the file is created, with the permissions that have been assigned to the "Creator Owner" group (see here, for example: http://technet.microsoft.c
Maybe of interest, too:
Utility Spotlight Script Elevation PowerToys for Windows Vista
http://technet.microsoft.c
Administrators accounts are only members of Administrators group; and we're not using DENY settings at all.
Duplicate Administrators group into other group, created only for manage file security, it's almost the same than give explicit permissions to each member of the Administrators group, but as long as there is no better solution for the problem, we're going to do it like that. Thanks to all of you.
And to Microsoft: This is probably the worst security design for a system I've seen in over 20 years working with you guys, perhaps comparable only to the obligation to shut down a server to automatically update it, instead of restarting it; this is great for all of us that have to manage servers in remote data centers.
I think Microsoft has lost his head, and other body parts, to give pleasure to all Linux fans who say that Microsoft systems are less secure than the Unix ones, and they have forgotten that a system is as safe as its administrator is. I guess if you follow this path the next will be an operating system that can not be used in any way: this will be really safe.
Business Accounts
Answer for Membership
by: SeeMeShakinMyHeadPosted on 2009-08-27 at 15:38:54ID: 25203319
Check out this and should solve your problems: http://www.trainsignaltrai
Th