Server 2008: You don't currently have permission to access this folder

[HAL07]

I get this popup all the time when logging in to a server as a member of the Domain admins (not administrator) and try to go into
directories I've not been in before.

I then have to Click Continue and I get a UAC popup that edits the security ACLs on the folder.
After, I see that my username is added with the new permissions:
- Read & Execute
- List folder contents
- Read

However I am a member of Domain Admins. How can Windows then still ask me for access to a folder?
Doesn't Windows Server 2008 file explorer support nested groups?

[Meinolf Weber [MVP-DS]]

Hello HAL07,

When an administrator logs on to a computer running Windows Vista or Windows
Server 2008, the user is assigned two separate access tokens. Access tokens,
which contain a user's group membership and authorization and access control
data, are used by Windows® to control what resources and tasks the user can
access.

The only account that has the FULL control is the administrator account.
All other admins are prompted with UAC. You have the following options:
- disable UAC
- run all with the "Run as Administrator..." option.
- check out and TEST the GPO, Computer configuration, windows settings, security
settings, local policies, security options, "User account control: Behavior
of the elevation prompt for administrators in Admin Approval Mode", choose
"Elevate without prompting".

In my opinion you should NOT use that policy. It lowers the security tremendous.

[HAL07]

Thanks, however I wonder why traversing a directory triggers UAC, even if one has access to it.
Especially on a server.

Thanks, however I wonder why traversing a directory triggers UAC, even if one has access to it.
Especially on a server.

That page seemed to render incorrectly in Firefox

Thanks for the info anyways.

[Meinolf Weber [MVP-DS]]

Hello HAL07,

Maybe this gives you more infos, how UAC works:
http://technet.microsoft.com/en-us/l.../cc505883.aspx

[Meinolf Weber [MVP-DS]]

Hello HAL07,

IE shows it correct.

[HAL07]

I found a solution for this. Just use another computer and work with folders and files using \\SERVER\d$ etc
Then you are not asked for these annoying popups.

[da crusher]

I have been researching the same 'features'. I don't mind being prompted for
performing administrative functions, but it doesn't appear that the Local
System Policy or anything else provides enough granularity to where you can
exempt just the folder/file structure access - it's either all or none.

[dondersconsulting]

I believe I have found a viable solution for this (at least for me). I made a Universal Security Group called "File System Admins", added my administrative users, and gave it full rights to my server's D: partition. (made sure it propagated to subfolders - you may have to tweak a couple folders or use advanced button to replace permissions on subfolders). This partition holds all the user data folders/shares, which is the only place I really need to monkey around with much.

After it applied, and I verified the Group name was in the security list but my user account was not, I tried browsing. It didn't work! Still got the pop-up for edit security! Oops, forgot to log off and log back in so the logged in user account will know it belongs to the new group. After doing so, I was able to browse into the subfolders and no pop-ups!