1

So I created a VHD for testing some permissions on a computer attached to a domain

The VHD is mounted as E:\

Inside of E:\ I have created a folder called web (so e:\web)

I right click on the web folder in E, go to Properties > Security > Advanced

Here is what my permissions tab looks like

enter image description here

If I click on the Effective Permissions tab and enter a username, I would assume that if this user is a member of my local admin group, or local users group they should have Full Control (for admins) and if they are users they would have read/execute perms.

However, when I enter the name of someone who is not a member of the local admin group, just a standard user on the domain, i get the following

enter image description here

What is going on here? Does this have something to do with the local Users group having read and execute permissions on the folder? Is there some way to lock out standard domain users from being able to view this folder?

Richie086
  • 5,351

2 Answers2

0

SO I figured it out. The answer is simple enough. When a computer is joined to a windows domain, the local group 'Users' has the global Domain Users group added to it. That is why users were able to authenticate to this folder.

Richie086
  • 5,351
0

the Windows Server documentation states that the Effective Permission feature on Windows Explorer provides only an approximation of the real effective permissions that apply to a user. You can read here or googling about the boring same words... Windows Explorer does not resolve an entire permissions chain on a file system object, in case of nested AD groups or cross-domain (or subdomain) accounts Windows Explorer does not show to you the real permissions. To verify the entire permissions chain, based on real permissions on file system, you need to use a external tool or system like Data Rover EP.It was really decisive for the needs of my company (...and it allowed me to make a good impression with my boss :P ).

Gizeh
  • 31