RE: How to Grant Power Users rights to administrative shares.

Dear Customer,

Thank you for posting to the SBS Newsgroup.

I am sorry but I can not have a clear image what exact issue or concern in
your post. In order to supplement your description, I need your help to
gather the following information:

1. You mentioned "We have an account admin group that needs rights to
create shares when assigned to the power user group it give them rights to
create shares but when they use the create a shared folder wizard and hit
browse all they see are the administrative shares which they don't have
access to."

My Conclusion is:

Your Power Users run the Share a Folder Wizard on the SBS Server to create
some shared folders. However, I am not sure which one is your current
issue:

a. Client cannot access Shared Folder.

OR

b. Clients can access Shared Folder which they should not have accessed.

2. I strongly suggest that you please fully explain your steps so I can
reproduce your issue on my test machine.

3. Did you meet any error messages? If yes, please type the full content of
the error message word by word to the Newsgroup for accurate research.

4. On the problematic computer, On the server, run "eventvwr" (without
quotation marks), check whether there are any errors. If yes, double click
it, click the Copy button and paste the full content to the Newsgroup.

5. My Suggestion:

Please check the permission settings of the shared folders. Generally
speaking, the shared folder permission is combined with NTFS permission and
Sharing permission. You may check the NTFS permissions and the sharing
permissions. You may assign 'Everyone' with 'Full control' sharing
permission, at least "Change" Permission.

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
================================================== ====
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
================================================== ====
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>From: "peachy" <>
>Newsgroups: microsoft.public.windows.server.sbs
>Subject: How to Grant Power Users rights to administrative shares.
>Date: 1 Mar 2006 13:44:52 -0800
>Organization: http://groups.google.com
>Lines: 10
>Message-ID: < .com>
>NNTP-Posting-Host: 207.164.255.166
>Mime-Version: 1.0
>Content-Type: text/plain; charset="iso-8859-1"
>X-Trace: posting.google.com 1141249497 28682 127.0.0.1 (1 Mar 2006
21:44:57 GMT)
>X-Complaints-To: groups-
>NNTP-Posting-Date: Wed, 1 Mar 2006 21:44:57 +0000 (UTC)
>User-Agent: G2/0.2
>X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
NET CLR 1.1.4322),gzip(gfe),gzip(gfe)
>Complaints-To: groups-
>Injection-Info: e56g2000cwe.googlegroups.com; posting-host=207.164.255.166;
> posting-account=Demu6g0AAABnV6JzG7trSjte9Br0tCzQ
>Path:
TK2MSFTNGXA03.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfee d00.sul.t-online.de!t-onli
ne.de!news.glorb.com!postnews.google.com!e56g2000c we.googlegroups.com!not-fo
r-mail
>Xref: TK2MSFTNGXA03.phx.gbl microsoft.public.windows.server.sbs:248550
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>I was wondering if there is an easy way to grant power users rights to
>administrative shares on multiple File and Print Servers.
>
>We have an account admin group that needs rights to create shares when
>assigned to the power user group it give them rights to create shares
>but when they use the create a shared folder wizard and hit browse all
>they see are the administrative shares which they don't have access to.
>
>any help??
>
>

This is on windows server 2003.

1. from there desktop right click on my computer click manage
2. right click on connect to another computer and type in the server name.
3. expand system tools
4. expand shared folders and click on shares
5. right click shares and select new file share
6. The "Create A Shared Folder Wizard" opens click next.
7. The next screen should display the server your connected to. Click Browse.
8. After you click on browse it lists the server name and the following drives

C$
E$
F$
Q$

there are plus signs beside all of these. when they try and expand these
folders they can't becasue the dont have enough rights. So the above drives
seem as thought there are administrative shares. What rights should i give
them to browse, list the files, create, and move the shares. Without giving
them functionality to remote console the box. Also remember that I want to
do this over multiple file servers in our organization.


""Brandy Nee [MSFT]"" wrote:

> Dear Customer,
>
> Thank you for posting to the SBS Newsgroup.
>
> I am sorry but I can not have a clear image what exact issue or concern in
> your post. In order to supplement your description, I need your help to
> gather the following information:
>
> 1. You mentioned "We have an account admin group that needs rights to
> create shares when assigned to the power user group it give them rights to
> create shares but when they use the create a shared folder wizard and hit
> browse all they see are the administrative shares which they don't have
> access to."
>
> My Conclusion is:
>
> Your Power Users run the Share a Folder Wizard on the SBS Server to create
> some shared folders. However, I am not sure which one is your current
> issue:
>
> a. Client cannot access Shared Folder.
>
> OR
>
> b. Clients can access Shared Folder which they should not have accessed.
>
> 2. I strongly suggest that you please fully explain your steps so I can
> reproduce your issue on my test machine.
>
> 3. Did you meet any error messages? If yes, please type the full content of
> the error message word by word to the Newsgroup for accurate research.
>
> 4. On the problematic computer, On the server, run "eventvwr" (without
> quotation marks), check whether there are any errors. If yes, double click
> it, click the Copy button and paste the full content to the Newsgroup.
>
> 5. My Suggestion:
>
> Please check the permission settings of the shared folders. Generally
> speaking, the shared folder permission is combined with NTFS permission and
> Sharing permission. You may check the NTFS permissions and the sharing
> permissions. You may assign 'Everyone' with 'Full control' sharing
> permission, at least "Change" Permission.
>
> Best regards,
>
> Brandy Nee
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
> ================================================== ====
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities...s/default.aspx
>
> When opening a new thread via the web interface, we recommend you check the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ================================================== ====
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
>
> --------------------
> >From: "peachy" <>
> >Newsgroups: microsoft.public.windows.server.sbs
> >Subject: How to Grant Power Users rights to administrative shares.
> >Date: 1 Mar 2006 13:44:52 -0800
> >Organization: http://groups.google.com
> >Lines: 10
> >Message-ID: < .com>
> >NNTP-Posting-Host: 207.164.255.166
> >Mime-Version: 1.0
> >Content-Type: text/plain; charset="iso-8859-1"
> >X-Trace: posting.google.com 1141249497 28682 127.0.0.1 (1 Mar 2006
> 21:44:57 GMT)
> >X-Complaints-To: groups-
> >NNTP-Posting-Date: Wed, 1 Mar 2006 21:44:57 +0000 (UTC)
> >User-Agent: G2/0.2
> >X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
> .NET CLR 1.1.4322),gzip(gfe),gzip(gfe)
> >Complaints-To: groups-
> >Injection-Info: e56g2000cwe.googlegroups.com; posting-host=207.164.255.166;
> > posting-account=Demu6g0AAABnV6JzG7trSjte9Br0tCzQ
> >Path:
> TK2MSFTNGXA03.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfee d00.sul.t-online.de!t-onli
> ne.de!news.glorb.com!postnews.google.com!e56g2000c we.googlegroups.com!not-fo
> r-mail
> >Xref: TK2MSFTNGXA03.phx.gbl microsoft.public.windows.server.sbs:248550
> >X-Tomcat-NG: microsoft.public.windows.server.sbs
> >
> >I was wondering if there is an easy way to grant power users rights to
> >administrative shares on multiple File and Print Servers.
> >
> >We have an account admin group that needs rights to create shares when
> >assigned to the power user group it give them rights to create shares
> >but when they use the create a shared folder wizard and hit browse all
> >they see are the administrative shares which they don't have access to.
> >
> >any help??


When they use the wizard

Dear Customer,

Thank you for posting back and keeping us updated!

From your description, I understand that you want to access some drives on
the member servers in Computer Management. If I have misunderstood your
concern, please let me know.

You can make some settings on those specific member servers to allow those
power users to access. To do so, please see:

1. Go to one of the member server that you allow power clients to access.
2. Right click My Computer, select Manager. Then Computer Management window
will come out.
3. Expand to Computer Management (Local)\System Tools\Local Users and
Groups\Groups.
4. On the right pane, double click Administrators.
5. Add those power users' accounts you allow to access are listed in the
Member pool.
6. Go to the other member servers which you allow power users to access,
and perform the same steps above.
7. Go to those member servers which you do not allow power users to access,
make sure those power users account are not listed in the Administrators
Groups.

Hope this information helps. If you have any questions or concerns on this
issue, please feel free to let me know. I am looking forward to hearing
from you.

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
================================================== ====
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
================================================== ====
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>Thread-Topic: How to Grant Power Users rights to administrative shares.
>thread-index: AcZBPIC9POFpIvEqRW6okGz+1FDGKg==
>X-WBNR-Posting-Host: 207.164.255.166
>From: =?Utf-8?B?cGVhY2h5?= <>
>References: < .com>
<tzi#>
>Subject: RE: How to Grant Power Users rights to administrative shares.
>Date: Mon, 6 Mar 2006 08:39:14 -0800
>Lines: 144
>Message-ID: <ED7CC4D5-B814-4675-8F5A->
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
>Newsgroups: microsoft.public.windows.server.sbs
>Path: TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA03.phx.gbl microsoft.public.windows.server.sbs:249799
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>This is on windows server 2003.
>
>1. from there desktop right click on my computer click manage
>2. right click on connect to another computer and type in the server name.
>3. expand system tools
>4. expand shared folders and click on shares
>5. right click shares and select new file share
>6. The "Create A Shared Folder Wizard" opens click next.
>7. The next screen should display the server your connected to. Click
Browse.
>8. After you click on browse it lists the server name and the following
drives
>
>C$
>E$
>F$
>Q$
>
>there are plus signs beside all of these. when they try and expand these
>folders they can't becasue the dont have enough rights. So the above
drives
>seem as thought there are administrative shares. What rights should i give
>them to browse, list the files, create, and move the shares. Without
giving
>them functionality to remote console the box. Also remember that I want
to
>do this over multiple file servers in our organization.
>
>

by giving them the rights that you have specified that would give them the
rights they need but it would also give them something I don't want them to
have which is the ability to remote the server.

Any other ways I can do it?

""Brandy Nee [MSFT]"" wrote:

> Dear Customer,
>
> Thank you for posting back and keeping us updated!
>
> From your description, I understand that you want to access some drives on
> the member servers in Computer Management. If I have misunderstood your
> concern, please let me know.
>
> You can make some settings on those specific member servers to allow those
> power users to access. To do so, please see:
>
> 1. Go to one of the member server that you allow power clients to access.
> 2. Right click My Computer, select Manager. Then Computer Management window
> will come out.
> 3. Expand to Computer Management (Local)\System Tools\Local Users and
> Groups\Groups.
> 4. On the right pane, double click Administrators.
> 5. Add those power users' accounts you allow to access are listed in the
> Member pool.
> 6. Go to the other member servers which you allow power users to access,
> and perform the same steps above.
> 7. Go to those member servers which you do not allow power users to access,
> make sure those power users account are not listed in the Administrators
> Groups.
>
> Hope this information helps. If you have any questions or concerns on this
> issue, please feel free to let me know. I am looking forward to hearing
> from you.
>
> Best regards,
>
> Brandy Nee
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
> ================================================== ====
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities...s/default.aspx
>
> When opening a new thread via the web interface, we recommend you check the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ================================================== ====
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
>
> --------------------
> >Thread-Topic: How to Grant Power Users rights to administrative shares.
> >thread-index: AcZBPIC9POFpIvEqRW6okGz+1FDGKg==
> >X-WBNR-Posting-Host: 207.164.255.166
> >From: =?Utf-8?B?cGVhY2h5?= <>
> >References: < .com>
> <tzi#>
> >Subject: RE: How to Grant Power Users rights to administrative shares.
> >Date: Mon, 6 Mar 2006 08:39:14 -0800
> >Lines: 144
> >Message-ID: <ED7CC4D5-B814-4675-8F5A->
> >MIME-Version: 1.0
> >Content-Type: text/plain;
> > charset="Utf-8"
> >Content-Transfer-Encoding: 7bit
> >X-Newsreader: Microsoft CDO for Windows 2000
> >Content-Class: urn:content-classes:message
> >Importance: normal
> >Priority: normal
> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
> >Newsgroups: microsoft.public.windows.server.sbs
> >Path: TK2MSFTNGXA03.phx.gbl
> >Xref: TK2MSFTNGXA03.phx.gbl microsoft.public.windows.server.sbs:249799
> >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
> >X-Tomcat-NG: microsoft.public.windows.server.sbs
> >
> >This is on windows server 2003.
> >
> >1. from there desktop right click on my computer click manage
> >2. right click on connect to another computer and type in the server name.
> >3. expand system tools
> >4. expand shared folders and click on shares
> >5. right click shares and select new file share
> >6. The "Create A Shared Folder Wizard" opens click next.
> >7. The next screen should display the server your connected to. Click
> Browse.
> >8. After you click on browse it lists the server name and the following
> drives
> >
> >C$
> >E$
> >F$
> >Q$
> >
> >there are plus signs beside all of these. when they try and expand these
> >folders they can't becasue the dont have enough rights. So the above
> drives
> >seem as thought there are administrative shares. What rights should i give
> >them to browse, list the files, create, and move the shares. Without
> giving
> >them functionality to remote console the box. Also remember that I want
> to
> >do this over multiple file servers in our organization.
> >
> >
>
>

Dear Customer,

Thank you for posting back!

Could you please be more specific on "give them something I don't want
them", so I can perform deeper research for you. For example, what exact
files, folders you want to grant what exact permissions to those power
users.

Thanks a lot for your time and I am looking forward to hearing from you!

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
================================================== ====
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
================================================== ====
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>Thread-Topic: How to Grant Power Users rights to administrative shares.
>thread-index: AcZB9nkGjAeiy1+NRYyXTVdiJdbkag==
>X-WBNR-Posting-Host: 207.164.255.166
>From: =?Utf-8?B?cGVhY2h5?= <>
>References: < .com>
<tzi#>
<ED7CC4D5-B814-4675-8F5A->
<>
>Subject: RE: How to Grant Power Users rights to administrative shares.
>Date: Tue, 7 Mar 2006 06:50:27 -0800
>Lines: 128
>Message-ID: <553558DB-33F9-4E7D-8BAF->
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
>Newsgroups: microsoft.public.windows.server.sbs
>Path: TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA03.phx.gbl microsoft.public.windows.server.sbs:250167
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>by giving them the rights that you have specified that would give them the
>rights they need but it would also give them something I don't want them
to
>have which is the ability to remote the server.
>
>Any other ways I can do it?
>