When accessing a folder on a Windows file server, it prompts saying "You don't currently have permission to access this folder". Now I know this folder has the following permissions set on it:
- SYSTEM - Full Control
- Administrators - Full Control
- Users - Create Folder append data
If I click continue to this prompt, UAC will automatically add my user name with full control permissions to the folder and all sub folders and files which I'm attempting to access. With multiple administrators maintaining a file server this results in unwanted user name ACL's spread across folders and files throughout the file server making the permission structure a mess.
After many years and now with the release of Windows Server 2012 this issue is still occurring. It's about time we spend some time and work out what's going on.
After leasing with some colleagues of mine in Microsoft who work on the file services team they told me three group policy settings are responsible for this behaviour which can be found under:
Computer Configuration --> Windows Settings --> Security Settings --> Local Policies --> Security Options
- User Account Control: Admin Approval Mode for the Built-in Administrator account
- User Account Control: Behaviour of the elevation prompt for administrators in Admin Approval Mode
- User Account Control: Run all administrators in Admin Approval Mode
- Elevate without prompting
Now when my administrators navigate the file server they are no longer prompted to add their account to NTFS permissions and in result making a mess of my NTFS permission structure.