Security – Detect files of folders which do not inherit permissions from their parent

Q1: Is there a way to restore at least read access to all files/folders to the Administrator account in a recursive fashion?

If permissions are inherited (ie. not set separately on different files and folders) then changing the permissions on the root folder and setting the "Replace all child object..." checkbox will replace all the permissions with inherited permissions.

This will of course replace permissions on child items that are supposed to have different permissions.

Q2: Is there a way to prevent users from removing Administrator from files/folders permissions on Windows Server 2003/2008?

No.

While there is a separate flag for "Change Permissions" Windows will ignored this for the owner of the file (the owner can always change the permissions), otherwise an empty ACL (or one with deny everyone everything ACE) wouldn't be reversible.

we can't even backup files manually as we get permission errors.

Why would you want such manual operations? Backup software should be run with and assert the backup (and on restore, the restore) privilege which will bypass ACLs. If the user needs to manually backup some part of their files that they own then they can easily copy.

Perhaps this is really an issue of user training: if you deny administrators access then administrators cannot help you with file management.

A) Write a small web form and a small script that will create a group and a directory for a project.

B) Write a small windows batch file that will do the same over ssh. You can use the ssh client from the cygwin project or some native windows ssh client.