Windows server files and folders permissions mess

permissionswindows-server-2008

I have a Windows Server 2008 R2 box, which is set up as a very basic file server in a Workgroup environment. We have a single Shared folder, with subfolders for each department. For some reason all the file and folders permissions are messed up.

I get Access Denied messages all the time, even as Administrator, and several programs can't get to their files any more. Backups are also starting to fail due this.

I know the problem is permission related but don't know the best way to restore them to a default state. Attempting to grant Administtrator permissions also fails.

What do I do? Are there any tools available that can help to assist? Ideally, I'd like to wipe the slate clean, remove all permissions, and grant only Administrator full permissions. Then grant permissions on a per folder basis, one at a time.

Best Answer

Take ownership as administrator of the root of the share. Check the box that applies the ownership change to all subcontainers as well. After you're owner, you can set the permissions to whatever you want.

If you want a default set of permissions, just figure out whatever those are. Then tick the boxes that replaces all permissions on the child objects with inheritable permissions from the top-level folder, like this:

Related Solutions

Windows – Force ownership of folder structure without replacing other permissions – Windows Server 2008 R2 – takeown is erasing all other permissions

Ended up achieving what I wanted with Setacl. I wrote the following script which ripped through the entire folder structure and files, and gave ownership to the local Administrators group, then went through again and added a full control ACE for our IT domain group. It did this without replacing or removing the existing permissions/ACEs (other than replacing the owner), and I didn't get any access denied errors:

setlocal

set logDir=%1
set targetDir=%2
set logFileName=%~n2
set logFileNameEnding=%3

SetACL.exe -on %targetDir% -ot file -actn setowner -ownr "n:S-1-5-32-544;s:y" -rec cont_obj -log "%logDir%\%logFileName%-TAKEOWN-%LogFileNameEnding%.txt" -silent

SetACL.exe -on %targetDir% -ot file -actn ace -ace "n:domain\group;p:full;s:n;m:set;w:dacl" -rec cont_obj -log "%logDir%\%logFileName%-ADD-DOMAIN-GROUP-%LogFileNameEnding%.txt" -silent

endlocal

Windows – Why does removing the EVERYONE group prevent domain admins from accessing a drive

I have noticed this myself. What happens, is that UAC kicks in because you are using your "local administrators" membership to gain access to the drive, and this is excatly what UAC monitors for.

For file servers, my personal best practice is to never use the "Administrators" group to provide permissions for users.

Try this: Create an AD group called "FileServerAdmins" or whatever, add your user (or domain admin group) to it. Give this group access to the D-drive with the same permissions as the existing Administrators group.

You should notice that even after removing the "Everyone" permission any members of the "FileServerAdmins" group should still have access to the drive, without getting the UAC prompt.

I was a bit shocked myself when I discovered this a while back, it is defenitely a part of UAC that could use some revision...

Best Answer

Related Solutions

Windows – Force ownership of folder structure without replacing other permissions – Windows Server 2008 R2 – takeown is erasing all other permissions

Windows – Why does removing the EVERYONE group prevent domain admins from accessing a drive

Related Topic