0

I have a small... problem atm. that could get bigger if I go further whitout knowing what I'm doing.

So this happened:

I have a Windows Server 2012 R2

It has 2 drives. C: & D:

I wanted to give the usergroup Users more permission to change files in a specific folder.

I recognized the user was in the Administrators group and actually should be able to change files in folder XY. Now after I granted rights to the Users-Group... he suddenly could change files there. All fine untill here.

My thought was:

may the admin-rights has to be refreshed so other users in the admin group won't run into the same problem

. What I did is:

D: => Right Click => Properties => Security

Selected Administrators => Edit and took away the first checkbox. After exapting this, I dropped my hand on my head and realized that my rights are gone. And now I'm not able to grand them anymore for this folder or directory.

I thoughts where:

may you just change the owner

But since I already have made this mistake I'm afraid to do the next one because inetpub and ftproot is running under D: and I don't know what will happen with the IIS and its rights when I change that.

Any suggestion to solve this ? Or to get the rights back for this folder ?

As information: I was logged in as administrator and took the right from the folder of the adminsitratorsgroup. But I still have access!

EDIT: This is not a duplicate of Access denied to a folder after removing administrator permission. I DO have access to the folder! I only want all rights back. Thats some diffrent!!!! Also the posted possible duplicate doesnt even has a really answere! Specialy not suitable with my question.

0

1 Answer 1

1

You are correct in thinking that you should change the owner.

  • You will not be able to change the administrators group back to full control unless you take ownership in this case.
  • When taking ownership, make sure to not "Replace all child object permission entries with inheritable permission entries from this object"
  • Since you will be changing the ownership of the root drive D: and not propagating permissions, no down-level permissions will be affected, including IIS folders like inetpub.
  • Once you have changed ownership of D: to administrators you will be able to tick full control again for the administrators group. This will enable you to make further permission changes.

If you do need to reset the IIS permissions for any reason, the following MS KB lists all permissions that apply to IIS 7, 7.5 and 8 (8 in your case being Server 2012 R2) https://support.microsoft.com/en-us/kb/981949

Also, please note: It may be worth re-structuring the way your folder structure is setup. It would be better to have a folder structure as follows:

D:\Shares\Share1
D:\Shares\Share2
D:\Shares\XY

This way you can set your root permissions on D:\Shares and no folders under D: will be affected.

I always setup a group for Backup_Operators which my backup software can be a member of which has full control of the root and all subfolders. I also have a Fileshare_Operators group which has full control of the root and all subfolders for administritive purposes. After those groups are setup, you can setup specific role based groups for your users and grant permissions as appropriate.

1
  • Thank you for this answere... also thank you for this nice explanation. My folderstructure is set up as you sayed... it was before :D the usere i wanted to grade all rights was in the admin group as well but still had problems. So unfortunately I had this wrong thinking in my mind "resetting" the rights by turn them off and on again :D
    – Dwza
    Nov 14, 2016 at 10:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .