User in domain admin group cannot access directory the group has permission to access
I've run into a rather interesting issue when playing with one of my domain labs.
There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. The directory has the following permissions set:
- FILESERVER\Administrators: Allow full control to the directory, subdirectories, and files
- DOMAIN\Domain Admins: Allow full control to the directory, subdirectories, and files
- Authenticated Users: Allow create files, create folders, write attributes, and write extended attributes to the top directory only
In addition, the directory is also a network share with "Allow full control" to the Authenticated Users group.
When user john.doe, a member of the domain admins group, tries to access the directory from the fileserver, he gets the error "You don't currently have permission to access this folder". Trying to access the network share from the same server also results in a permission denied error (although the user can still access his own directory within the share).
Accessing the share from another computer logged on as the same user allows access as configured.
The only way you can access the files in the directory while logged on to the file server is by opening an elevated command prompt. UAC is disabled for all computers in the domain through Group Policy (Run all administrators in Admin Approval mode enabled, and default behavior set to elevate without prompting).
All roads point to the user being allowed access, but it's still being denied. Any ideas?
This is by design. UAC strips the admin credential from any un-elevated process. If you're attempting to use an un-elevated process to access a remote share using only admin credentials, UAC will strip the admin credentials from the process' security token and the process will receive an "access denied" error.
To remedy this you can:
Don't use admin credentials to secure the folder (create a generic group just for this purpose), or
Disable UAC on the fileserver (not recommended), or
Enable the following registry key on the fileserver to disable just this portion of UAC.
More info: Description of User Account Control and remote restrictions in Windows Vista
UAC is stripping off the Domain Admin credentials on the server itself, it's part of how UAC (stupidly IMO) works. One option is to disable UAC on the server completely to not receive the "You don't currently have permission to access this folder" prompt.
EDIT: here's an example thread btw: http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/9061bc1c-42ea-47ed-8c7d-56b07139fb86/
EDIT2: John's answer below might be exactly what you are looking for though. Try it out and report back if you can.