Re: Unable to access folders in "Users Shared Folders"

Hi Anthony,

Thanks for your update.

I am Crina and backup of Jenny due to her leave.

From all the thread, I understand the issue to be: Domain Administrator can
not access subfolders locate in the "Users Shared Folders". However the
administrator can access the root folder. Also you do not want to take
ownership to solve the issue.

From current situation, please check as following:

1. Right click the "Users Shared Folders" and then select Properties.
2. Click Security tab and then click Advanced.
3. Double click the Domain Admins and then on Object tab check if you have
selected This folders, subfolders and files in Apply onto column.

If the configuration is correct, please check if the NTFS permissions and
the Sharing permissions to the Users Shared Folder are properly set:

Also normally we can configure NTFS permissions and the Sharing permissions
to the Users Shared folder as following:

NTFS permissions:

Domain Admin: Full Control
Domain Users Special - Apply onto "This folder and files" -Allow: Traverse
Folder/Execute Files, List Folder/Read Data, Read Attributes, Read Extended
Attributes, Create Folders/Append Data, Read Permissions
System: Full Control
SBS Folder Operators: Full Control

Sharing permissions:

Domain Admins, Domain Users, SBS Folder Operators: Full Control

NTFS permissions for the individual Users Folder:

Domain Admin Full Control (Inherited)
System Full Control (Inherited)
SBS Folder Operators Full Control (Inherited)
Individual user Full Control (Not Inherited)

For detailed configuration, you can refer to the following documents:

Access Control How To...
http://www.microsoft.com/technet/pro.../library/Serve
rHelp/e8854fff-2f01-454a-9d94-6557b4f45a4f.mspx

User Rights Technical Reference Topics
http://www.microsoft.com/technet/pro.../techref/useri
gt.mspx

325361 How To Configure Security for Files and Folders on a Network in
Windows
http://support.microsoft.com/?id=325361

I appreciate your time and look forward to hearing from you.

Best regards,

Crina Li (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

================================================== ===
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

================================================== ===

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| From: "Garbis" <>
| Newsgroups: microsoft.public.windows.server.sbs
| Subject: Re: Unable to access folders in "Users Shared Folders"
| Date: 26 Jul 2006 21:57:15 -0700
| Organization: http://groups.google.com
| Lines: 70
| Message-ID: < .com>
| References: < om>
| <>
| NNTP-Posting-Host: 72.165.205.102
| Mime-Version: 1.0
| Content-Type: text/plain; charset="iso-8859-1"
| X-Trace: posting.google.com 1153976241 25049 127.0.0.1 (27 Jul 2006
04:57:21 GMT)
| X-Complaints-To: groups-
| NNTP-Posting-Date: Thu, 27 Jul 2006 04:57:21 +0000 (UTC)
| In-Reply-To: <>
| User-Agent: G2/0.2
| X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
SV1),gzip(gfe),gzip(gfe)
| Complaints-To: groups-
| Injection-Info: m73g2000cwd.googlegroups.com; posting-host=72.165.205.102;
| posting-account=LPTghw0AAACd6dIrwn_wzxAGfInXi_uR
| Path:
TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFT FEEDS01.phx.gbl!newsfeed00
sul.t-online.de!t-online.de!border2.nntp.dca.giganews.com!border1.nn tp.dca.
giganews.com!nntp.giganews.com!postnews.google.com !m73g2000cwd.googlegroups.
com!not-for-mail
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:284687
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Thanks for the reply.
|
| So even as a domain administrator, I can't access a users home
| directory on the network? I have the security permission set to full
| control for domain admins, so I don't see how that makes sense.
| Shouldn't I be able to access everything?
|
| Yes, the user can access her documents/desktop files.
|
| One thing to note, on my server:
|
| \\Server\Users\username, I can access files in that root directory.
| However, if I were to go to \\Server\Users\username\my documents, I
| can't see anything.
|
| There has to be a way to override having to take ownership to view
| those files...?
|
|
| Chad A. Gross [SBS-MVP] wrote:
| > This sounds like normal behavior. When you redirect users' folders to a
| > share on the server (e.g. My Documents, Desktop, etc.) - by default each
| > user is granted exclusive rights to their redirected folders - meaning
that
| > by default not even the administrator can view the files. Since the
| > Administrator does not have basic permissions on these folders, nothing
| > happened to these folders when you set the security, because the
| > administrator account hasn't been granted permissions to set the
security
| > for those folders. Make Sense?
| >
| > So the big question is - can the users access their own folders? If so
-
| > then you're fine :^)
| >
| > Any domain administrator can take ownership of those folders so that
they
| > can set security - just be aware that the end users need to have
ownership
| > on their folders in order for folder redirection to work.
| >
| > --
| >
| > Chad A. Gross [SBS-MVP]
| > SBS ROCKS!
| > www.msmvps.com/blogs/cgross
| > www.mobitech.biz
| >
| > "Garbis" <> wrote in message
| > news: ps.com...
| > >I moved this folder from the C:\ to the D:\ as explained in the
| > > Microsoft tech article.
| > >
| > > I moved over all the data, used the "Share this folder" wizard,
granted
| > > the share permissions as stated in the article:
| > >
| > > Domain Admins - Full Control
| > > Domain Users - Full Control
| > > SBS Folder Operators - Full Control
| > >
| > > That part goes fine.
| > >
| > > The problem is that I don't know what to set the security to.
| > >
| > > Could someone please read me what their settings are? Just to test I
| > > set security for Domain Admins at full control, and I'm still locked
| > > out of some folders. I tried to look at one users my documents, and
it
| > > said denied. How is this possible if I granted full control to domain
| > > admins, and I'm logged in as administrator? I can access the users
| > > "folder" but none of the sub folders within there. I set the advanced
| > > security permissions to "this folder, subfolders, and all files" also.
| > >
| > > Thanks.
| > >
|
|