Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I created a VHD for testing some permissions on a computer attached to a domain

The VHD is mounted as E:\

Inside of E:\ I have created a folder called web (so e:\web)

I right click on the web folder in E, go to Properties > Security > Advanced

Here is what my permissions tab looks like

enter image description here

If I click on the Effective Permissions tab and enter a username, I would assume that if this user is a member of my local admin group, or local users group they should have Full Control (for admins) and if they are users they would have read/execute perms.

However, when I enter the name of someone who is not a member of the local admin group, just a standard user on the domain, i get the following

enter image description here

What is going on here? Does this have something to do with the local Users group having read and execute permissions on the folder? Is there some way to lock out standard domain users from being able to view this folder?

share|improve this question
up vote 0 down vote accepted

SO I figured it out. The answer is simple enough. When a computer is joined to a windows domain, the local group 'Users' has the global Domain Users group added to it. That is why users were able to authenticate to this folder.

share|improve this answer
Doesn’t explain why they have “Create files / write data” and “Create folders / append data” permissions. What’s hiding under the “Special” permissions that the Users group has? – Scott May 23 '13 at 23:50

the Windows Server documentation states that the Effective Permission feature on Windows Explorer provides only an approximation of the real effective permissions that apply to a user. You can read here or googling about the boring same words... Windows Explorer does not resolve an entire permissions chain on a file system object, in case of nested AD groups or cross-domain (or subdomain) accounts Windows Explorer does not show to you the real permissions. To verify the entire permissions chain, based on real permissions on file system, you need to use a external tool or system like Data Rover EP.It was really decisive for the needs of my company (...and it allowed me to make a good impression with my boss :P ).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .