I am on a home network and not using a domain controller. My username is in the administrators group and I have UAC turned on. I have a share on a network computer that has certain rights for users of the administrators group (the group itself has permissions). However, I find that it is not honoring those permissions, but have to explicitly add my username to this ACL in order to have access.

Why won't this work, since both usernames are under an administrators group? Does this not matter the group when accessing a remote share or does it only authenticate at the user level? Thanks.


The most restrictive permissions are followed. So if there is a denied for your account, but allowed for administrators, you will be denied.

  • What if a "Users" group was on the same list, but with lesser permissions. Would it follow the Users' permissions first? – Ryan Peters Jun 12 '11 at 23:12
  • It follows the most restrictive. – soandos Jun 12 '11 at 23:14
  • Right, so you're saying it is seeing my (remote) user as part of the Users group rather than the Administrators group? – Ryan Peters Jun 12 '11 at 23:23
  • Check what groups your user is a member of. – soandos Jun 12 '11 at 23:23
  • 1
    This is just not true. All Administrators are members of the Users group anyway, and if you ever put Everyone: read on a file, no one would be able to write to it. If you're talking about the most restrictive permissions between NTFS and Share, then that's a different story. – NReilingh Dec 21 '13 at 4:10

This is the most annoying problem in Vista and above. Microsoft added Admin Approval Mode (A.A.M.).

Example from the article linked below:

When accessing a folder in Windows Explorer, it prompts saying "You don't currently have permission to access this folder". Now I know this folder has the following permissions set on it:

  • SYSTEM - Full Control
  • Administrators - Full Control
  • Users - Create Folder append data

My user account is a member of Administrators. I should have permission to access this folder.

Well, A.A.M. will give all "Administrators" group members a "Standard User" access token on start-up of Explorer. So when you click the folder a User Access Control (U.A.C.) will pop-up asking for permission. This will add your user as a separate A.C.L. (Access Control List) entry and give you the same permissions as "Administrators".

Two Solutions to this:

  1. Create a new group with the same permissions as an Admin, add your user to this group, add this group to the folder you want to access. You will have full access without prompt or a separate User A.C.L. entry being added.
  2. Disable A.A.M. Click Here
  • For this use, the only LSP setting you SHOULD have to change (at least according to my testing just now, and presuming the behavior of the elevation prompt is permissible enough, which it is by default on server 2008 r2) is "User Account Control: Run all administrators in Admin Approval Mode" (requires reboot). – NReilingh Dec 21 '13 at 22:13

You need several things:

  1. Since it is not a domain, and thus not really one user, you need the user AND password to be the same on both computers. This allows for pass-through authentication.
  2. You need to set the Share's permissions to allow access, usually full for the administrator, and do it not for the administrator's group. I suspect this is where you are failing since the administrator on computer 1 is not really in the administrator's group on computer 2 since they are different users.
  3. You need to set the security permissions on the files. Again, I would set these permissions for the individual administrator user.

As noted by soandos, the most restrictive permissions will apply, so if you only have read on the share permissions, it will not matter if you have full control on the security permissions.

  • To make sure I understand what you're saying. Yes, setting the security (I have the share all set up as needed) for the administrators group will not work, but rather it MUST be set per individual user (also, I do have matching user accounts on both machines). – Ryan Peters Jun 12 '11 at 23:14
  • I am used to working in domains, but it seems to me that since the only way this works is pass-through authentication, meaning both username and password have to match, how can you do that with groups since they have no passwords regardless of membership. – KCotreau Jun 12 '11 at 23:41
  • Let me also add that it follow the most restrictive between the share and security permissions. If you have a user, who is an admin and has full permissions, but also a member of the users group and has limited permissions, and we are talking security permissions, that person has full permissions. If you added only read permissions for the share, even an admin would be limited to read permissions. – KCotreau Jun 12 '11 at 23:45
  • The exception is a deny permission...that overrides all. – KCotreau Jun 12 '11 at 23:46
  • Both users have the same username/password. Both are in the administrators' group. However, I cannot access with full permissions for the Administrators group. It seems like it's not seeing the account as being part of this group. Is this true or is something messed up? – Ryan Peters Jun 13 '11 at 1:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.