Use a GPO to give read-access to local file system on multiple servers

Posted on 2006-06-01
Last Modified: 2008-02-01
We have hundreds of servers in our environment and I want to give certain support personnel read only access to the C:\ and D:\ volumes.  I want to create a local group on servers that need this named 'ProductionSupport' and insert domain accounts into this group.  This way if I need to give developers read access to a new server all I need to do is create a local ProductionSupport group and add members to the group.  My question is how do I setup my GPO?  

When I go into Group Policy Management from my workstation, memberserver or domain controller for that matter and navigate to:Computer Configuration\Windows Settings\Security Settings\File System and click Add File, I am only able to add domain groups.  

Is there a way to add the 'ProductionSupport' group so it is exists locally on any server in the domain the GPO will grant members of this local group read access to the local file systems?

Question by:bangia_v
    LVL 4

    Expert Comment


    Do you want a seperate group for each server or one group that will give the same permissions, to every group member, for all servers? ie

    " I want to give certain support personnel read only access to the C:\ and D:\ volumes." on all servers or only certain personel on certain servers.



    LVL 16

    Expert Comment

    You can only create local groups on member servers (not domain controllers) using lusrmgr.msc
    that on a member server is go to

    LVL 69

    Expert Comment

    would power users work just as a suggestion?

    Author Comment

    Unfortunately they can't be power users.  I figured it out last night however.  Here's how I did it:

    Using my local desktop, Group Policy Management and two servers. (let's call them server_a and server_b) I created a local group on each of the servers called ProductionSupport.  I created a domain group called CRMSupport and put a test_user into it.  I then nested CRMSupport into the ProductionSupport group on both servers.

    On my desktop (let's call it desktop)I created a local group called ProductionSupport.  Using Group Policy Management (from my desktop) I created and linked a new GPO to the OU where server_a and server_b were located.  

    Inside GP management, I navigated to Computer Configuration\Windows Settings\Security Settings\File System and then gave the 'DESKTOP\ProductionSupport' local group read/execute rights to C:\ and D:\.  The only local groups available to me were ones on my own machine.  

    I waited about an hour and when I logged into server_a and server_b as test_user (I did also add CRMSupport to the Remote Desktop Users group on both servers) the test_users account was granted read/execute to both the C:\ and D:\ volumes.  

    I had no idea this would work.  I thought that since I was assigning read/execute to DESKTOP\ProductionSupport via GPO that only this local group on my machine would have these rights.  It turns out that as long as a local group exists on the server in question (has to be the same name) it doesn't matter that the SID's are different.  

    Again I haven't seen any documentation from MS that this should work but I did get it to work last night.  I'm going to try expand it to other servers today.
    LVL 69

    Expert Comment

    :) clever you.

    Accepted Solution

    PAQed with points refunded (500)

    Community Support Moderator

    Featured Post

    Better Security Awareness With Threat Intelligence

    See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

    Join & Write a Comment

    Suggested Solutions

    Introduction Often we come across situations wherein our batch files would be needing to reboot Windows for a variety of reasons. A few of them would be like: (1) Setup files have been updated whose changes can take effect only after a reboot …
    Windows 7 does not have the best desktop search built in. This is something Windows 7 users have struggled with. You type something in, and your search results don’t always match what you are looking for, or it doesn’t actually work at all. There ar…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…

    730 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now