User can access share only if that user is granted permission, not when Admin group (which he is a member of) is given permission

hsehestedt · Jul 29, 2022

This has been an issue that I've observed for a long time, but I've ignored it simply because there is such an easy workaround. It's finally bugging me enough that I thought I'd try to understand what is happening.

Let's suppose that I have the following scenario:

I have Windows 10 or 11 Pro. I log on as JohnDoe and JohnDoe is a member of the Administrators group.

I create a share and give both read and write access to the Administrators group.

Now, I try to connect to that share from another computer using the username JohnDoe but am denied access.

Next, I modify the share permissions to specifically add the user JohnDoe with read and write access.

After doing this, JohnDoe can access the share successfully.

Question: Why can JohnDoe not access the share when the Administrators group is given access but only when JohnDoe is specifically added to the share permissions? Again, bear in mind that JohnDoe is a member of Administrators.

LeLibran · Jul 29, 2022

hsehestedt said:
Question: Why can JohnDoe not access the share when the Administrators group is given access but only when JohnDoe is specifically added to the share permissions? Again, bear in mind that JohnDoe is a member of Administrators.

Because, under some circumstances, especially in 'work environments', you may not want all users with administrative privileges to be able to access a shared folder that's only intended for use by a specific sub-group; and the alternative would be to have many more named groups to manage.

hsehestedt · Jul 29, 2022

LeLibran said:
Because, under some circumstances, especially in 'work environments', you may not want all users with administrative privileges to be able to access a shared folder that's only intended for use by a specific sub-group; and the alternative would be to have many more named groups to manage.

If I didn't want all Administrators to have access to a resource, then I would not add the "Administrators" group to the to the permissions

.

That's why you have the ability to create customized groups into which you can add specific users.

SlicEnDicE · Jul 30, 2022

I agree, this does not make sense. Managing groups and its members is exacltly the purpose so that specific user groups can be given access to specific features.

But have you tried to create a new group "SMBUsers" or some other name and tried given that group permissions. Maybe the Administrators group is special?

SlicEnDicE · Jul 30, 2022

One idea:

Try logging in as JohnDoe@RemoteComputerName instead of just JohnDoe.

SlicEnDicE · Jul 30, 2022

OK, I see your issue now...I have same problem connecting from a Windows 10 computer into a Windows 11 computer. No Permissions. :think:

SlicEnDicE · Jul 30, 2022

Permissions also works if you use the Everyone group...but not using any other groups, even if the group has been given ALL network and folder permissions. This is weird...

Ruben · Jul 30, 2022

Share perms and NTFS perms are 2 diff. things. When you create a shared folder in the share perms. you add Everyone and give them R/W access and in the Adv. Perms. you remove everyone and give access to the spec. grp or people you do want to share with

SlicEnDicE · Jul 30, 2022

Ruben said:
Share perms and NTFS perms are 2 diff. things. When you create a shared folder in the share perms. you add Everyone and give them R/W access and in the Adv. Perms. you remove everyone and give access to the spec. grp or people you do want to share with

Yeah, that does not work...

SlicEnDicE · Jul 30, 2022

This issue is a Windows 10/11 problem...works perfectly between Win10 computers...not sure about Win11 computers...

SlicEnDicE · Jul 30, 2022

Could this be an issue on non domain connected devices? :think:

SlicEnDicE · Jul 30, 2022

Seems Windows permissions are a bit weird...If "Everyone" is given full access, then everything works, but for some reason even after adding a group with less permissions everyone still has full access.

If Everyone is left out, then nobody has access. Not even administrators even if the group has full access. Does not make any difference if permissions are modified on filesystem level, share level or both. Everyone access is required.

I don't remember this being this odd. Although Windows permission management has always been a bit weird.

Too many patched protection layers?

cereberus · Jul 30, 2022

Windows 11 does seem to be more onerous than W10. I find I have to set up user credentials to make it work reliably.

SlicEnDicE · Jul 30, 2022

Yeah, I tried this locally on a Win11 machine and I could not make it work so that default acces is zero and depending on group I give more and more access.

cereberus · Jul 30, 2022

SlicEnDicE said:
Yeah, I tried this locally on a Win11 machine and I could not make it work so that default acces is zero and depending on group I give more and more access.

Yeah - it is a mess. I cannot say if it is bugs or W11 is more onerous - I suspect a combination of both.

User can access share only if that user is granted permission, not when Admin group (which he is a member of) is given permission

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Similar threads