Domain Administrator does not have permission to remove a folder

active-directorypermissionswindows 7

I am a Windows domain administrator, and on my Windows 7 machine I have a folder that is owned by another domain user. When I right click and attempt to delete, it tells me that I don't have permission.

I logged out as myself and logged in as the domain administrator's account, attempted to delete, and again I am told that I don't have permission.

I logged out and logged back in as myself, and installed the latest version of Cygwin. Then I went to the folder above the offending folder, and performed rm -r offendingfolder. It worked. The folder is gone.

I presume there's no magic behind Cygwin and it uses the Windows authentication mechanism, so I need to know: Why couldn't I do this under Windows itself?

Thanks.

Best Answer

Why is this question downvoted? He asks why it works with Cygwin.

I don't know exactly. My guess is, Cygwin has a clever trick to grant a group full control/modify by taking ownership to a specific file/folder prior to removing it. But, again, that's speculation from my point of view, studying source code is not one of my daily routines.

It can be done through native Windows tools. For example, see KB268019 on taking ownership. It explicitly states:

Taking ownership does not automatically grant you permission to access it. You have to explicitly give the administrator permission to the folders and files.

When you are owner, you can change permission entries. Which, in this case, boils down to assigning your account at least 'Modify'-permissions to remove the offending folder.

Related Solutions

I have administrative rights on Windows Server 2003, so why am I denied access to a folder

You would have to take ownership of the folder. Under the Security tab, go to Advanced, switch to the Owner tab, and replace ownership on that folder (and its subfolders if you need it).

Once you do that, you can change the permissions as you need. If you cannot take ownership, you're not really an administrator.

Iis – IUSR vs ADMINISTRATOR permission snag

Note the two lines you have:

er.exe:2240 OPEN C:\WINDOWS\debug\UserMode\ChkAcc.log ACCESS DENIED MY-SERVER\IUSR_MY-SERVER  
er.exe:2240 CREATE C:\WINDOWS\debug\UserMode\ChkAcc.log ACCESS DENIED MY-SERVER\IUSR_MY-SERVER

The first line might be the application checking whether it exists, while the second line makes for a "create file if it does not exist" situation. The things I would look for is that the IUSR account is not part of the "USERS" group, but is part of "GUESTS", and generally guests have even less privileges than "USERS". You may want to ensure that the IUSR account have the ability to TRAVERSE the folders above it. Try giving the IUSR account explicit access to traverse the folders, and the permission on the "UserMode" folder to "Create Files" (but "THIS FOLDER ONLY").

Finally, there maybe explicit "deny" permissions for guests that may prevent you from accessing the folders. Those are the things I would check.

Best Answer

Related Solutions

I have administrative rights on Windows Server 2003, so why am I denied access to a folder

Iis – IUSR vs ADMINISTRATOR permission snag

Related Topic