Folder Access

I am the administrator for our network......    Learning by the seat of my pants on most everything.    Why are some folders stating that even me logged in as administrator that I don't have access.   At times I need to look into a users set of folders and get denied.

Is there a reason it "defaults" this way?   Reason a network admin should not have access...........
Who is Participating?
ReceptConnect With a Mentor Commented:
Ok, in that case the folder is restricted to the point that even SERVERNAME\Administrators doesn't have access.

Therefore the best course of action is to take ownership, check the permissions and grant SERVERNAME\Administrators and Admin_users Full Control access.

Some permissions may have been changed, here is a Technet article which will step you through the method for changing permissions if you need to:
bankwestCTO/CashierAuthor Commented:
As an administrator, can I make myself the "owner" and then make sure the user or the group they are in have the correct permissions.   Or is that a no-no for a network?
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

I believe this is the problem you are experiencing -

This applies to all Windows versions which have User Access Control (UAC) - Windows Server 2008+/Windows Vista+

Put simply Windows Explorer does not (and can not) run with the elevated permissions required to view the folders.

Rather than take ownership of the folder a good test is to launch command prompt with elevated permissions (right click -> Run as Administrator) and browse to the same folder.

There are a few solutions outlined in the article above but I've previously used option 2 as turning off UAC is not good security practice.

If this is not possible what I found works is to create a new group in Active Directory and call it something like “All-Folders-Access”. Add your administrator account to this group and then give this group full control permissions to the same folders the administrators groups have access to. This will allow you access to the folder with Windows Explorer. This is time consuming but the only solution if you want to keep UAC in use.
bankwestCTO/CashierAuthor Commented:
Reading thru this and still a little confused.  In my Active Directory, of course, there is the built in Admin account, which I am a member of.

Then we have under our domain_OU,  we have another group that is just called Admin_users and I am a member of that as well.

So what am I missing???     I still have issues with some folders.  And if I look at the folder, security,  I find a few that says I don't have permission to view or edit   If I go to the root, for example,    \\domain\user_mydocs I see the Admin group listed with full control.   But then I go to a users folder and the access is denied.

Sorry....trying to learn this as I go.
Apologies if it was unclear. The BUILTIN\Administrators group I'm referring to is the one local to the file server. Going forward I will refer to it as SERVERNAME\Administrators.

I suspect if you look at the permissions to the folders you don't have permissions to their simply have SERVERNAME\Administrators and not the Admin_users group. As SERVERNAME\Administrators is the only group listed with UAC enabled you will not have permissions to the folder.

The fix is to add the Admin_users group to the folder but first lets check the folder permissions. You can do this with a command line tool like ICACLS.

1. RDP to the server
2. Shift + Right click and open Command Prompt as an Administrator
3. Type icacls <path to folder>
For example icacls c:\data\folder1

Post the results and we can go from there.
bankwestCTO/CashierAuthor Commented:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\tcox>icacls C:\shares\user_mydocs\mvoss
C:\shares\user_mydocs\mvoss: The system cannot find the path specified.
Successfully processed 0 files; Failed processing 1 files

C:\Users\tcox>icacls C:\shares\usr_mydocs\mvoss
C:\shares\usr_mydocs\mvoss: Access is denied.
Successfully processed 0 files; Failed processing 1 files

bankwestCTO/CashierAuthor Commented:
Where is the best PLACE to do this.   On the domain under the share and storage management?   Or just use explorer and access each folder
I'd do it by using explorer and access each folder.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.