Re: Don't Administrators have access to everything?

RESOLUTION achieved, sort of. After
(1) returning the folders to the Shared Documents folder,
(2) giving Users full control of the folders and files, and
(3) copying the folders back to where I wanted them,
I could edit the permissions to achieve the desired results
(well, almost): The Administrators accounts can access
the files and the Users cannot.

PUZZLE 1: If I MOVE the folders, they end up with
NO owner and no one has access to the files (not
even Administrator), but making a COPY applied
the correct inherited permissions. [Note that this
discovery invalidates one of my earlier contentions,
that "I already AM owner." Also, even though my
account had been granted Full Control, I didn't
actually get full control until I took ownership and
said Yes when asked if I wanted to also have full
control.]

PUZZLE 2: The Limited Account user cannot open
the files, but I really wanted to hide them from even
being seen by that user. I could not find a way to
accomplish that without also messing up the
Owner's and Administrators' permissions.

"Jim" wrote:

"John W." <JohnW@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote ...
"Jim" wrote:

"Shenan Stanley" wrote:

John W. wrote:
There are two Administrator accounts on my
XP Pro system, and I recently added a Limited
user. All of the files I had been using were in
the Shared Documents folder, which the Limited
users get access to. I didn't want them to have
access to some folders, so I moved those to
another folder under C:\ and made sure both
Administrator users had Full Control access to
the folders and files. (Simple File Sharing was
turned off long ago.) One of the Administrators
is the Owner of nearly every file that was moved.
Now, NO USER has access to most of the moved
files, not even the Administrator who is listed as
their Owner. I can't figure out what is special
about the few that can be opened, but I thought
the Administrators group had access to all files.
What gives?

Look into taking ownership of the files.
--
Shenan Stanley
MS-MVP
--
"John W." <JohnW@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote ...
I already AM owner! Still, I tried taking ownership again. No luck.
Since when does the owner not have access to the file?


<...snip...>

Two answers in one...
1) No, the files are not encrypted.
2) Both Administrators were granted Full Control permissions,
as I stated originally. Some files show Owner having Full
Control and others show Owner having only Special Permissions.
3) I vote for the corrupted OS.

And more: When accessing the Advanced security, I get the
message that I don't have permission to _view_ the settings but
I can _change_ them. Now that's wierd.

New clue #1: The owner is (was) a member of both
Administrators and Users. Is the Users restriction maybe overriding
the Admin privilege? Simply taking them out of Users didn't clear
any problems, but if I give Everybody access, I can open the file.
On the one file I worked with, I could then change Users back to
a limited access and still open that file from the Admin account.
This looks like a feasible, although painfully tedious, path to a
solution.

For item 2):
A member of the administrators group should grant the Owner Full Control
over all files. A member of the administrators group can always do this.

Yes, a member of the administrators group who does not have permission to
view the settings can nevertheless set them. This is normal behavior.

Jim
.

Relevant Pages

  • Re: Access Denied when editing GPO
    ... I checked the "Owner" on some of the GPO folders on my DC (a small one I ... folder has "Domain Admins ... User Accounts" (Administrators is a group, ...
    (microsoft.public.win2000.group_policy)
  • Re: Folders security, permissions
    ... On two different folders, in the D: ... Owner is set to Administrators ... permissions and just have everything accessible to ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Deleting Network Files
    ... Give them full control of their own folders on the server as well as ... the administrators group. ... > Windows NT 4.0 as the network software. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Turn off Simple File Sharing
    ... Even in XP Pro it amazes me that in certain folders don't have Administrators granted full control. ... When you go messing with permissions it's always a good idea to pay close attention and really understand what you're doing. ...
    (microsoft.public.windowsxp.general)
  • Re: Dont Administrators have access to everything?
    ... returning the folders to the Shared Documents folder, ... NO owner and no one has access to the files (not ... account had been granted Full Control, ... Owner's and Administrators' permissions. ...
    (microsoft.public.windowsxp.security_admin)