• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 532
  • Last Modified:

Domain Admin and share/folder permissions

I would like to know if a Domain Admin has ,by default, full control permission on the shares and NTFS folders.
I believe Domain Admin can add his account and give it Full control on the NTFS folders and Share permissions, but not by default. I could be wrong.

any comments on this ?

thanks
0
jskfan
Asked:
jskfan
  • 4
  • 3
  • 3
2 Solutions
 
BeartlaoiCommented:
Default is usually Administrators gets full permissions and by default Domain Admins is a member of Administrators.
Any of this can be changed so don't assume.
0
 
Brad BouchardInformation Systems Security OfficerCommented:
As long as you haven't altered any permissions to begin with then yes Domain Admins always have permission.  The only way you could have screwed this up was to remove inheritance on the advanced portion of the sharing/security.
0
 
jskfanAuthor Commented:
Sometimes as a domain admin, when I use : \\servername\sharename
I can see some folders but some of them I cannot, does that mean they removed the inheritance on the folders I cannot see ?
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Brad BouchardInformation Systems Security OfficerCommented:
That could potentially mean that those folders were "unshared."  RDP to the server, navigate to those folders you can't see when you go \\servername\share and right click and properties and make sure that they are set to both inherit permissions and be shared.
0
 
BeartlaoiCommented:
Inheritance does not automatically include admins, it simply means it gets permissions from its parent.  If admins were removed from the root of a drive, or were never there when the drive was created, then it would not be in the children even if inheritance is on.

If you need to get access to them you can, but be careful.
You should already be a member of local Administrators group (it should include Domain Admins).
Go into the security properties of the folder you dont see, look at the current owner.
Make sure the current owner has full permissions.
Take ownership of the folder (best is Administrators).
Grant yourself, or better yet Administrators full permissions.
Look at inheritance.

In some organizations, full permissions to some data is removed from the admins.
Like in a Bank, the IT staff should not have access to all the data.
So consider this when you are granting yourself permissions to stuff, will someone in your organization jam you up for it?
0
 
Brad BouchardInformation Systems Security OfficerCommented:
Inheritance does not automatically include admins, it simply means it gets permissions from its parent.  If admins were removed from the root of a drive, or were never there when the drive was created, then it would not be in the children even if inheritance is on.

Domain admins are given access to these folders by default my friend, so like I said initially unless something has changed they should be there.
0
 
BeartlaoiCommented:
That is supposed to happen but in my long experience I have seen situations where it does not.  Bottom line is to not make any assumptions, check everything and find the root cause.
0
 
Brad BouchardInformation Systems Security OfficerCommented:
That is supposed to happen but in my long experience I have seen situations where it does not.

It is always there, again unless someone changed something; what specific examples have you been in where it hasn't because I'd be quite curious to know?

Bottom line is to not make any assumptions, check everything and find the root cause.

Agreed, which is what I've been helping the author do.
0
 
jskfanAuthor Commented:
Thank you Guys
0
 
jskfanAuthor Commented:
Thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: CompTIA Cloud+

The CompTIA Cloud+ Basic training course will teach you about cloud concepts and models, data storage, networking, and network infrastructure.

  • 4
  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now