Re: Please help with folder permissions

I am not intending to encourage use of admin by all of the local logins,
but given that you have said they must be, then you might want to check
out the policy, in the security options section, under system objects,
"Default owner for objects created by members of the Administrators group"

Given that all are admins, the separation of access that is being
effected by all of this effort is more in appearance than in any
sort of actual fact.


<fkthespam@xxxxxxxxxxxxxx> wrote in message
news:1178098650.273686.197060@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Just to add to this I have sort of figured out what it is.

All the domain users are a member of the local administrators group.

It would seem that when a user creates a folder the creater owner
becomes the local admin group not the user!!

If I remove domain users from local administrators it all works fine!
The user becomes the owner not the local admin group.

The problem now though is the users have to be a member of the local
admin group.

Any help or suggestions on this would be much appretiated!



.

Relevant Pages

  • Re: No user accounts that are Enterpise Admins can connect to othe
    ... of the Enterprise Admin group and the sid is there. ... Basically it is from one of the child domains connecting to member servers ... the members of the Child domain's admin group are ...
    (microsoft.public.windows.server.active_directory)
  • Re: Admin Privs without being in the administrator group
    ... I'm beginning to believe that you have to be a member of the ... administrators group to do this regardless of whether or not you have the ... > admin membership given only in its initial, but changable, behaviors. ... I've given the user full control of the hard ...
    (microsoft.public.windows.server.security)
  • Re: User Rights on Domain but Admin Rights on Computer
    ... Any domain account can be added as a member ... of a particular machine's Administrators group to make that domain ... account an admin on that one machine. ...
    (microsoft.public.windows.server.security)
  • Re: Domain Admin Locked out!
    ... >group policy to - the ORGANIZATIONAL UNIT only. ... still being a member ... >the administrators group while the restricted groups is ... >> domain admin. ...
    (microsoft.public.win2000.security)
  • Re: How to make give cross-domain "Domain Admins" permissions
    ... or at using Enterprise Admin for some things. ... I don't want to have admin privileges over all member ... I'd add a domain local group to the administrators group in each domain ...
    (microsoft.public.windows.server.active_directory)