DFSRoots directory permissions problem
Posted on 2011-04-28
I am having a strange problem.
We recently moved our existing DFS shares to a new Windows Server 2008 system. We use ABE (Access Based Enumeration) in our environment, so we have to be very careful with the permissions.
When we normally create a new DFS Namespace or add a new server to the Namespace Server list, we have to ensure that the permissions of the DFSRoots folder for the namespace are the same as the true folder permissions for the actual share.
We normally do this by a script that uses the cacls command to modify all of the folders at one time. However, since we have moved to Server 2008, when I try to change the permissions on a folder in the DFSRoots directory it states that "access is denied". I am currently using a Domain Admin account and the owner of the folder is the Domain Admins groups for my domain, so I am not seeing the permissions issue.
Has anyone run into this before, or can someone help me see what I am missing?