ITINITIATIVES
asked on
Administrator account cannot access user documents folder
We have a folder that is used for users files for group policy. The administrator has full permissions for each level of the directory (ie. D:/ full control, User_Docs full control, <username> full control. However, when attempting to access the My Documents folder in the <username> folder, access denied. This is an issue because the items are not getting backed up. The system account also has the same permissions.
and if that doesn't work, start with a different name for the initial folder and change your group policy to point to the proper location
ASKER
Hmm...
Do you think if we select the "replace permission entries to this object and all child objects - include these with entries explicity defined here" option, this would resolve the issue? We don't want to screw up the permissions where the users aren't able to access their files...
Thanks.
Do you think if we select the "replace permission entries to this object and all child objects - include these with entries explicity defined here" option, this would resolve the issue? We don't want to screw up the permissions where the users aren't able to access their files...
Thanks.
yeah, just make sure you don't open up any security holes...
That's by design. The user folders are user folders and even the administrator can't access them (without taking ownership of the folders and changing the permissions).
An account in the Backup Operators group should be able to back them up.
An account in the Backup Operators group should be able to back them up.
ASKER
That won't delect the existing permissions entries for that folder, right?
I wouldn't change the permissions on the folders. This could cause access problems even if the users still have the necessary rights.
ASKER
Hmm... The administrator account is also associated with the backup operators group. However, it still can't backup and lists access denied when attempting to access the file.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
The user permissions are designed to be initially inaccessible to the adminstrator. Install the Windows Resource kit. (There is a version for NT4, 200 and 2003) Run admalow.exe from the Resource Kit. This will give Admistrators permissions to the user folder for archiving purposes.
ASKER
admalow.exe doesn't exist in the Windows 2003 resource kit. Is it possible a different command?
Hmm, for some reason, I thought it was in the resource kit. I guess I must have downloaded it long ago and it's always been in my path. http://www.google.com/search?hl=en&q=admnalow&btnG=Search
i would rename the problematic initial folder (making sure no files are in use)
recreate folder structure... verify and set perms again on the new folder>>
get the user data copied back into the newly created folder
verify permissions are being inherited properly
and then test