As per "Best Practices" staff in our IT department have two accounts. An unprivileged account et an account that is a member of le global Domain Admins ($DOMAIN\Domain Admins) group. On our file servers le Domain Admins group is added to le local Administrators ($SERVER\Administrators) group. The local Administrator group has Full Control granted on these directories. Pretty standard.
Cependant, si I login to le server avec mon Domain Admin account in order to descend into that directory J'ai besoin de to approve a UAC prompt that says, "You ne currently have permission to access this folder. Click continue to permanently get access to this folder." Clicking continue gives mon Domain Admin account permissions on that folder et anything else underneath despite $SERVER\Administrators (of qui Je suis a member of via le Domain Admins group) déjà having Fully Control.
Can someone explain this behavior et what le approprié way to manage NTFS permissions for file shares is regarding Administrative rights avec Server 2008 R2 et UAC?
NTFS - Les administrateurs du domaine n'ont pas les permissions malgré leur appartenance au groupe Administrateurs locaux
Re: NTFS - Les administrateurs du domaine n'ont pas les permissions malgré leur appartenance au groupe Administrateurs locaux
Right, UAC is triggered quand a program requests administrator privileges. Such as Explorer, requesting administrator privileges, parce que c'est what le NTFS ACLs on those files et folders require.
Vous avez four options Je suis aware of.
-
Disable UAC on votre servers.
- I do this anyway (in le general case), et would argue that si you need UAC on a server, you're probably doing it wrong, parce que in general, seulement administrators should log onto servers, et they should know what they're doing.
-
Manage le permissions depuis an elevated interface
- Elevated `cmd` window, `PS` window ou Explorer instance tous work for avoiding le UAC popup. (`Run As Administrator`)
-
Manage le NTFS permissions remotely
- Connect over UNC depuis a machine that ne have UAC turned on.
-
Créez unn additional non-administrative group that has full access in le NTFS ACLs to tous le files et folders you want to manipulate, et assign votre admins to it.
- The UAC popup ne va pas (shouldn't) be triggered, parce que Explorer will no longer require Administrative privileges, as access to le files is granted through another, non-administrative group.
Vous avez four options Je suis aware of.
-
Disable UAC on votre servers.
- I do this anyway (in le general case), et would argue that si you need UAC on a server, you're probably doing it wrong, parce que in general, seulement administrators should log onto servers, et they should know what they're doing.
-
Manage le permissions depuis an elevated interface
- Elevated `cmd` window, `PS` window ou Explorer instance tous work for avoiding le UAC popup. (`Run As Administrator`)
-
Manage le NTFS permissions remotely
- Connect over UNC depuis a machine that ne have UAC turned on.
-
Créez unn additional non-administrative group that has full access in le NTFS ACLs to tous le files et folders you want to manipulate, et assign votre admins to it.
- The UAC popup ne va pas (shouldn't) be triggered, parce que Explorer will no longer require Administrative privileges, as access to le files is granted through another, non-administrative group.