2

This seems like a which came first, chicken or the egg situation...

I have a folder that I have been shadow coping for a while. This has been working great and restores have been a breeze when a user accidently delete something. Until now...

  • DomainAdmin = Domain administrator who is part of the Domain Admin group.
  • UserA = Low level user with next to no access.
  • FolderA = A community folder used by all users to drop files into.
  • FolderB = Single users folder that only they have access to.

Lets just keep this simple and say this folder contains 10 files. All 10 of these files have ACLs that include the DomainAdmin group with full access to the files with the exception of 2 files. These 2 files ONLY have ACLs for the specific user that made them (UserA).

So every 12 hours a shadow copy is being made of this folder (FolderA). I get a request to restore the folder because someone (UserA) has deleted their file in the folder (FolderA). I go to restore it like usual but then get the following error...

File Access Denied

Interesting... So I go to open the shadow copy folder and see the file with the issue. I right click on it, go to properties and click the security tab to get this...

File Properties

So I say OK... nothing new... I have seen this before. I just need to take ownership of the file then change the ACLs like I see fit... So when trying to do that I get this...

Windows Security Error

Well... This is my delima. It seems that the file is in a state of read-only. Not by some type of attribute but something different based on the way a shadow copy happens. I tried to just copy the shadow copy folder (so that I could reset all the permissions but I can't copy those files due to the lack of ACLs!

Ideas? Solutions?

Improve this question
4
  • While I agree it's weird, a good heads up, and an answer would be awesome, it kind of makes sense. They want you, as the Domain Admin, to manage their files for them and recover them to cover for their mistakes, but don't want you to have permissions to access the files. One o the other. If they want to be solely responsible for their own files, then get the users to restore it from their personal backup they made. ;) – Ƭᴇcʜιᴇ007 Jan 20 '15 at 15:08
  • For an actual solution to your problem, just get the user to pull if form the shadow themselves. If that doesn't work, perhaps try giving the user Domain Admin permission long enough to pull the file from the shadow copy (as them)? – Ƭᴇcʜιᴇ007 Jan 20 '15 at 15:09
  • @Ƭᴇcʜιᴇ007 Can the standard user pull from shadow copies themselves? I thought that was an admin only function. Good work around but I hope that work around is not the only way (giving domain admin creds). :) – Arvo Bowen Jan 20 '15 at 16:00
  • Users should be able to by default (depending on file/folder permissions), that's kind of the point -- so they don't have to bug IT to recover files. :) – Ƭᴇcʜιᴇ007 Jan 20 '15 at 16:14
0

Have the user to pull it form the shadow copy themselves via the "Previous Versions" tab.

If that doesn't work for some reason, perhaps try giving the user Domain Admin permission long enough to pull the file from the shadow copy (as them).

Improve this answer
1
  • No luck. I tried all of those workarounds and I could not make it work. Seems as it stands right now the file in the shadow copy does not have ANY rights, none whatsoever. The owner is the domains Administrators group and that's it. Normally I would just take ownership of the file as a domain admin and then set the rights. But right now the shadow copy has it locked! No way out of the tunnel... – Arvo Bowen Jan 21 '15 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.