Solved

Win 2008 R2 NTFS permissions for home directories

Posted on 2010-08-16
9
2,228 Views
Last Modified: 2013-12-04
We recently began converting our domain to 2008 R2.
So we’re about 80% through upgrading all the domain controllers from 2003 R2.

I’ve set up home directories on a new 2008 r2 enterprise server.
And the users access those directories in the format \\servername\home\%username%

Share permission on HOME is Everyone FULL.

NTFS permissions on HOME have the following:
Domain admins – Full – This folder all subfolders and files
Authenticated users – Traverse folder/execute file, life folder/read data, read attributes, read permissions – this folder only

And then under each user’s home directory we give that user Full permissions.

This has worked in previous versions of windows server, allowing the users enough permissions to get down to their shares, but not so much that they can try and wander into another users home directory.

Here’s my problem with this Windows 2008 R2 server:

If I log in as the Domain\administrator account, I can access everything fine.
If I log in with another Domain Admin account I’m denied access to the users’ home directories. And it asks do I want to gain access, and if I say ‘YES’ it adds my individual account to the security permissions.
And for some reason I can’t log in as the local administrator, so I can’t test that. But that’s an oddity that I haven’t had occur before either.

Local administrator includes domain admins.

Any ideas? I am really stuck. This makes no sense whatsoever.
0
Comment
Question by:Kumerian
  • 5
  • 3
9 Comments
 
LVL 1

Expert Comment

by:czelik
ID: 33449758
did you try accessing it with ip address?
\\IPADDRESS\home\%username%
0
 

Author Comment

by:Kumerian
ID: 33459215
I'm logged into the server and accessing the local directory and having this problem.
0
 
LVL 1

Expert Comment

by:czelik
ID: 33461066
did you try adding domain admins in controll panel/user accounts as local administrator?
0
 

Author Comment

by:Kumerian
ID: 33466157
yes, they were added automatically when I added the server to the domain.
0
Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

 
LVL 1

Expert Comment

by:czelik
ID: 33607760
sorry, was out of town

What is the current owner of ntfs set to? Maybe change that to domain admins
0
 

Author Comment

by:Kumerian
ID: 33967857
I have the solution offline with Microsoft. Can I put it here or will you delete the question?
0
 

Accepted Solution

by:
Kumerian earned 0 total points
ID: 33967903
Apparently the issue is caused by the User Account Control in 2008R2.

According to Micrsooft, even though the Admin group has full access, the system will not allow a specific admin access without changing the permissions. This generates an audit log event, which provides for a trace of who has accessed the home directory beyond the user accessing it remotely. This was their way of providing an audit trail for admins accessing secure directories.

Fixed by disabling UAC.
0
 

Author Closing Comment

by:Kumerian
ID: 33999663
Tried this solution and the problem is completely resolved.
This is specific to 2008R2, 2008 does not exhibit this behavior.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now