What is the minimum rights required to access the Users directory on another computer via an admin share?

I have a batch file that writes some information to a few other computers using a path of \\%COMPUTERNAME%\c$\Users\%USERNAME%\AppData\Roaming. The batch files run under an unprivileged user (part of Domain Users only). How do I set appropriate rights so that service account can access the AppData\Roaming folder for every user on another computer?

I'd like to give rights lower than Local Admin, which I know will work.

Things I've attempted:

  1. As Domain Admin, attempted to give Modify rights to the C:\Users\ directory on the local computer. Error: Access Denied.
  2. Set the service account as Local Admin on the other computer. This works, but is against IT policy where I work. I'd like to accomplish this with rights lower than Local Admin.

Any suggestions?

  • Viewing or accessing another user's profile directory requires ownership of the folder. – Ramhound Jun 13 '14 at 15:06
  • 1
    Are you sure this information has to go into the user's Profile directory. There are better places for shared data. – Ramhound Jun 13 '14 at 15:18
  • Unfortunately, yes. We have some engineering/mapping software that stores location data in AppData\Roaming under each individual's user profile. The software is used for real-time incident mapping, so the batch file copies incident locations from a central source to each user directory on each computer that needs it... It's a mess, but it worked fine when the service account was a Domain Admin. – philipthegreat Jun 13 '14 at 15:44
  • Have you tried setting the ownership to this other user? Its working as an Administrator because those groups already have ownership. – Ramhound Jun 13 '14 at 15:52
  • I set ownership for the service account on C:\Users, and marked to push permissions to all subfolders and objects. Didn't work. I still get access denied when navigating to \\computer\c$\Users\ or \\computer\c$\Users\username\AppData\Roaming. – philipthegreat Jun 13 '14 at 16:31

According to Wikipedia,

Administrative shares cannot be accessed by users without administrative privileges.

In order to access \\computername\c$ at all, the service account must be a member of the Local Administrators group. The same goes for \\computername\admin$.

I tried to get around that by creating a new share called Users$ mapped to C:\Users on the local computer. I gave the service account Change rights on the share, and attempted to give Modify rights on the folder itself. I separately attempted to assign ownership of C:\Users to the service account.

This did not work as I had hoped. In setting rights, I got an Access is Denied error on several subfolders (for instance, C:\Users\username\AppData\Local for each user). As I only needed access to C:\Users\username\AppData\Roaming for each user, this came close to a workable solution, and was accessible from the other computer using \\computername\Users$\username\AppData\Roaming. The down side: Any new user logging in on that machine did not inherit the rights automatically. I had to reassign rights for each new user.

Ultimately, the IT department granted a policy exception giving local Admin to the service account on each computer affected, giving me unfettered access to \\computername\c$\Users\.

Thank you especially to @Ramhound for assistance in this matter.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.