SBS 2003 .. Administrator is NOT supreme??

[Omar Senussi]

Hi Guya n' Gals..

I am finding a rather strange effect in that if I try and copy files (logged in as Administrator) from a folder in the D partition say, to My Documents on C, I get file inaccessible .. yet a user can copy at will! Also If I try and see the properties of that file, I'm told I don't have sufficient rights!

Any ideas??

Checking the rights on that folder, I find Administrator has FULL rights and to the subdirectories and files.. Am I missing something here?

[Ivan Ferreira]

Go to security, advanced, effective permissions on both, the source and the destination folder. Select tha administrator user. What are the effective rights displayed? Isn't a crypted folder? Check if Encrypt contents to secure data is enabled in General, Advanced.

[Omar Senussi]

Hi,
Full rights.. as I would expect .. to folder and subfolders and files! Absolutely everything ticked.

[Ivan Ferreira · Accepted solution]

And what about that specific file, is encrypted? Try taking the ownership of the file. Security, advanced, owner.

Also run

whoami /user /groups

Ensure that your account still belongs to the administrators group.

[Pau Garcia i Quiles]

I've had similar problems with Windows sometimes.

Try to run a chkdsk for the volume that file belongs to and you'd probably find corrupt files. Just run chkdsk /f and ditto.

[Robert S. Carr]

Omar:

I feel your frustration. I've seen this problem more than once.

Ivan's ideas would have certainly been what I would have tried.

Anyway, Effective Permissions outline by Ivan should show you everything but could you try unclicking 'Allow inheritable permissions from the parent to propagate to this object and all child objects'? and let us know what happens?

Found in file properties->Security tab->Advanced button->Permissions. It's a little checkbox.

This tripped me up from time to time when I started to do Admin work on 2003 servers. it also fixed a lot of problems too.

Good luck.

Rob

[Omar Senussi]

Hi Guys,
Apologies for the delay in answering.

Ivan, there is definitely something funny about the permissions on the files in that particular folder.. not sure why.. Although I seem (Administrator!) to have full effective rights over the folder and parent folders.. I sometimes get a problem looking at the properties of the files...)

Robert.. 'Allow inheritable permissions from the parent to propagate to this object and all child objects'

If I uncheck on the folder containing the problem file(s) It asks whether to remove all previously granted rights etc.. mightimpact on other users??

So do I keep the original (copy) or delete the inherited rights??

[Ivan Ferreira]

You can copy the permissions and then configure them as you want. If you remove the permissions, you must configure all permissions for that folder from a scratch. You can also use the "Replace permissions entries on all child objects with entries shown here that apply to child objects" in the parent folder, so permissions will be propagated to all child objects.

[Omar Senussi]

Strange.. Well, I had to take ownership (as Administrator before I could resolve this... (I think I have!)
I always was under the impression that Administrator was the top dog! and didn't need to have folders rights assigned. Might be a peculiarity of SBS2003?.. or server 2003?? I will try a few tests on our own server (Server 2003.. NOT SBS)

Thanks to you all for all your suggestions..

[Robert S. Carr]

Omar:
>>>>
Robert.. 'Allow inheritable permissions from the parent to propagate to this object and all child objects'

If I uncheck on the folder containing the problem file(s) It asks whether to remove all previously granted rights etc.. mightimpact on other users??

So do I keep the original (copy) or delete the inherited rights??
<<<

As you point out there could be an unintended impact so only copy the permissions. With the permissions copied manipulate only 1 or 2 files and test them and note the impact of the change.

It was my experience that you could change permissions all day long but as long as a file/folder inherits rights from the folder above you can end up frustrating yourself to no end. Inheritance is great when you want subfolders to have the same permissions but sometimes you do not.

I believe the solution is close at hand. Administrators do have top level rights. Of course a user can set a file so that only he/see can see it but an admin can always take control when required. This is consistent in WinOS systems.

Try inheritance again and see what happens.

Rob

[WillNiccolls]

I've seen this before when migrating a user to an SBS server during the profile redirection. It might have to do with the ownership of the files by the local administrator on the pc? Or perhaps a local user that isn't associated with a domain account? In my case I think giving the domain admin local rights and then taking ownership, then reconfiguring the ACL worked.