Windows – How to grant somebody “Take ownership” privilege

filesystemspermissionswindowswindows-server-2008-r2

I have a Windows 2008 R2 machine. My machine itself is not a domain controller but is joined to a domain.

In Local Security Policy, under Security Settings > Local Policies > User Rights Assignment, grant user DOMAIN\jane.doe to have "Take ownership of files or other objects" privilege.

I rebooted the machine and login as DOMAIN\jane.doe. Open up the command prompt and do takeown /f c:\test\testfile.txt. It gives me "Access denied" error

The file was created by DOMAIN\administrator. Hence the owner was set to Administrators group.
Verified that there is no other GPO applied to the machine.

For testing purpose, I take out all DACL from the file and then just granted DOMAIN\jane.doe to have "Take ownership" permission via DACL. Then, login as DOMAIN\jane.doe and run the takeown /f c:\test\testfile.txt again. I could successfully take the ownership if the "Take ownership" permission is granted to DOMAIN\jane.doe via DACL.

My question is why does the user DOMAIN\jane.doe fail to obtain the file ownership even I granted her the privilege? Is it because takeown.exe doesn't honor the Windows privilege but only DACL? I did similar testing using the security property page from Windows Explorer. DOMAIN\jane.doe cannot take ownership even though she is granted to have "Take ownership" permission via DACL and she is granted to have "Take ownership of files or other objects" privilege.

Best Answer

I just worked out the answer. It's because I had UAC turned on. If I turn off the UAC, both takeown.exe and explorer.exe security properties work as expected. DOMAIN\jane.doe can take the ownership as expected.

Related Solutions

Windows – Useful Command-line Commands on Windows

A little known one is

getmac

It shows the MAC address(es) of your network adapter(s).

Screenshot of running getmac from a Windows commandline window.

File ownership for new files with administrator – why is it giving ownership to the group administrators

Update: This GP setting is no longer available starting with Vista/Server 2008. https://support.microsoft.com/en-us/kb/947721

A Group Policy setting is not available in the security policy settings list on a computer that is running Windows Server 2008
SYMPTOMS
When you try to access the "System objects: Default owner for objects created by members of the Administrators group" Group Policy setting on a computer that is running Windows Vista or newer, this setting is not available in the security policy settings list. When the setting is present in your security group policy, it will be ignored by Windows Vista and newer domain members.
CAUSE
Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 do not support this setting any longer. When enabled, User Account Control (UAC) will ensure the user account is being used as owner for all objects created locally. For remote access, the administrators group will be used there is no restricted token for network sessions.

Since the support for the setting was removed, the system security policy "System objects: Default owner for objects created by members of the Administrators group" setting is not available in the Security Templates user interface anymore.

Have a look in Group Policy for the setting "System objects: Default owner for objects created by members of the Administrators group". It's located under:

Computer Configuration
- Windows Settings
  - Security Settings
    - Local Policies
      - Security Options

When this setting is enabled members of the "Administrators" group will have objects they create set with the owner "Administrators".

To be honest, I'm not immediately sure on Microsoft's rationale for this behaviour, except to say that it would allow for a common ability to reset permissions on objects w/o taking ownership by all "Administrators". I'd guess that was the intent. I'd be interested to see if anybody has a link to an explicit statement of purpose on this setting from Microsoft.

I noticed that this setting's default differs between Windows XP and Windows Server 2003 (here's an article from Microsoft on it http://support.microsoft.com/kb/318825), but I still don't see a statement of purpose behind why you would want things set one way versus the other.

Related Topic