Score:0

Access denied to folder even though Domain Admins have Full Control

cn flag

I'm setting up a testing environment for permissions and I'm trying to understand what's going on here.

I have a Windows Server 2016 where my admin account used for testing is both a member of the local administrators group as well as the Domain Admins group. I have a folder where both the user, and the Domain Admins group, have Full Control. If I remove the user, but leave the Domain Admins with Full Control, I can no longer access the folder and get Access Denied both through windows explorer as well as Powershell (Get-ChildItem, Get-Acl, etc.)

Is there any logical reasoning for this happening? Shouldn't I be able to open/read/change the folder and its contents when Domain Admins has Full Control, and I am a member of Domain Admins? What am I missing here?

in flag
Is the powershell started with 'Run as administrator" so it is elevated? Are you sure this isn't a UAC issue?
cn flag
Run as admin was being used, I found some other blog post that I can't find now that mentioned UAC and that this is only an issue when trying to access it locally. I accessed the share from a different server and could access it so it was most likely that :) thanks for the help!
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.