Folder Access

Posted on 2013-10-28
Last Modified: 2013-11-03
I am the administrator for our network......    Learning by the seat of my pants on most everything.    Why are some folders stating that even me logged in as administrator that I don't have access.   At times I need to look into a users set of folders and get denied.

Is there a reason it "defaults" this way?   Reason a network admin should not have access...........
Question by:bankwest
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4

Expert Comment

ID: 39607142

Some permissions may have been changed, here is a Technet article which will step you through the method for changing permissions if you need to:

Author Comment

ID: 39607169
As an administrator, can I make myself the "owner" and then make sure the user or the group they are in have the correct permissions.   Or is that a no-no for a network?

Expert Comment

ID: 39607304
I believe this is the problem you are experiencing -

This applies to all Windows versions which have User Access Control (UAC) - Windows Server 2008+/Windows Vista+

Put simply Windows Explorer does not (and can not) run with the elevated permissions required to view the folders.

Rather than take ownership of the folder a good test is to launch command prompt with elevated permissions (right click -> Run as Administrator) and browse to the same folder.

There are a few solutions outlined in the article above but I've previously used option 2 as turning off UAC is not good security practice.

If this is not possible what I found works is to create a new group in Active Directory and call it something like “All-Folders-Access”. Add your administrator account to this group and then give this group full control permissions to the same folders the administrators groups have access to. This will allow you access to the folder with Windows Explorer. This is time consuming but the only solution if you want to keep UAC in use.
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 39608654
Reading thru this and still a little confused.  In my Active Directory, of course, there is the built in Admin account, which I am a member of.

Then we have under our domain_OU,  we have another group that is just called Admin_users and I am a member of that as well.

So what am I missing???     I still have issues with some folders.  And if I look at the folder, security,  I find a few that says I don't have permission to view or edit   If I go to the root, for example,    \\domain\user_mydocs I see the Admin group listed with full control.   But then I go to a users folder and the access is denied.

Sorry....trying to learn this as I go.

Expert Comment

ID: 39610279
Apologies if it was unclear. The BUILTIN\Administrators group I'm referring to is the one local to the file server. Going forward I will refer to it as SERVERNAME\Administrators.

I suspect if you look at the permissions to the folders you don't have permissions to their simply have SERVERNAME\Administrators and not the Admin_users group. As SERVERNAME\Administrators is the only group listed with UAC enabled you will not have permissions to the folder.

The fix is to add the Admin_users group to the folder but first lets check the folder permissions. You can do this with a command line tool like ICACLS.

1. RDP to the server
2. Shift + Right click and open Command Prompt as an Administrator
3. Type icacls <path to folder>
For example icacls c:\data\folder1

Post the results and we can go from there.

Author Comment

ID: 39610303
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\tcox>icacls C:\shares\user_mydocs\mvoss
C:\shares\user_mydocs\mvoss: The system cannot find the path specified.
Successfully processed 0 files; Failed processing 1 files

C:\Users\tcox>icacls C:\shares\usr_mydocs\mvoss
C:\shares\usr_mydocs\mvoss: Access is denied.
Successfully processed 0 files; Failed processing 1 files


Accepted Solution

Recept earned 500 total points
ID: 39610355
Ok, in that case the folder is restricted to the point that even SERVERNAME\Administrators doesn't have access.

Therefore the best course of action is to take ownership, check the permissions and grant SERVERNAME\Administrators and Admin_users Full Control access.

Author Comment

ID: 39618044
Where is the best PLACE to do this.   On the domain under the share and storage management?   Or just use explorer and access each folder

Expert Comment

ID: 39620381
I'd do it by using explorer and access each folder.

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
NTP problem 24 80
Modify Permissions in Windows Folders. 15 53
DNS forwarders "unable to resolve" 1 69
Determine what is creating a pagefile.sys file? 33 57
I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question