Confused about NTFS permissions and inheritance

[Mike Leone]

So I'm sure that my problem is that I'm misunderstanding, or not knowing, something about NTFS folder permissions and group inheritance.

Situation: a vendor is installing an application for us. He is logged in as the (domain) privileged account of my co-worker, Now,  this account is a member of a domain group ("Server_Admins"), and this domain group *is* a member of the local Amdinistrators group. I've verified that. (we push out that group via GPO to various servers).

Now, here's the odd part. The application is acting up, and the vendor is trying to edit the log file written by the application. The NTFS permissions of the log folder has local Administrators showing FULL control. So you would think, since he was logged in as a member of a domain group that is in turn, a member of the local Administrators group, that he could edit or delete sai file.

But you would be wrong ...

He's prompted for administrator permission to edit/modify/delete said file. I look at the permissions of the folder, and yes, I see local Administrators group inheriting FULL control. I check "Effective Access" under Advanced, and yep, that domain account he is logged in as, is showing green check marks on Full Control,. Write Attributes, Delete, all of it.

So what am I missing here? Why can't he edit this file? There's no DENY that I see under the Advanced options.

Since this is for troubleshooting purposes, and we needed to get past it, I just explicitly added that domain account at an upper level of that folder structure, and it all Just Worked. Why? I dunno. You would think the group inheritance would have allowed him to do all that, but no. Once the vendor finds the problem and fixes it, I can remove that explicit account name (we prefer permissions to only be assigned to groups, not users, makes life much simpler, especially when users leave the organization).

So: what am I not understanding or not knowing? Why couldn't that account edit the file via inherienance, and instead I needed to explicitly add it to the folder permissions?

Thanks

--

Mike. Leone, <mailto:tur...@mike-leone.com>

PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>

[Solodow, Damien]

Welcome to UAC. 😊

Normally when doing things as a member of the Administrators group, your session/process doesn’t have the “is Administrator” flag turned on (that’s the whole point of the “Run As Administrator” menu option).

Since the permissions via the ACL are for the Administrators group, unless he’s running the process as Administrator he doesn’t technically have the permissions.

$10 says if you granted permissions to the Server_Admins domain group, it would work as expected.

 

Damien Solodow IT Engineering Manager Gaylor Electric, Inc. 10405 Crosspoint Blvd Indianapolis, IN. 46256 O: 317.815.3103 | M: 317.506.8521

--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CAHBr%2B%2BhXMR5LKkii%2BxSUWYq3v51F5rFEZsQQu2JHQ0osNH3AAA%40mail.gmail.com.

[Michael B. Smith]

My typical solution to this is to open an elevated PS session and start all editing tools via the command prompt. Works fine. And I’m faster in the CLI anyway…

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/SN6PR04MB4766491ADA62E948AFB9895ABCE82%40SN6PR04MB4766.namprd04.prod.outlook.com.

[Mike Leone]

On Mon, Jun 29, 2026 at 12:05 PM Michael B. Smith <mic...@smithcons.com> wrote:

My typical solution to this is to open an elevated PS session and start all editing tools via the command prompt. Works fine. And I’m faster in the CLI anyway…

No doubt.  But he had just opened file explorer, navigated to the folder in question, and then went to edit file from there. He didn't start file explorer as Administrator (not a bad idea, as long as you're careful of what you're doing in there) and then go hunt down and edit the log. Perhaps next time ... I'll keep it in mind, tho.

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/528138ef7f8c42fabbbd26728ad04f7f%40smithcons.com.

[Sean Rector]

"But he had just opened file explorer, navigated to the folder in question, and then went to edit file from there."

Ding! Ding! Ding!

Sent with Proton Mail secure email.

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CAHBr%2B%2BiXY2VnFCKX2qRRfUyfAj2sZOBYDKqr3roHwH%2BweFcj9w%40mail.gmail.com.

[Hammer, Erich F]

I don't believe you can run Windows File Explorer elevated. You would have to use an alternative file explorer. That said, the standard Open dialog allows you to do a lot of things, so a few times, I've run Notepad as Admin just so I could access/alter/delete files within the Open dialog. 😊


On Monday, June 29, 2026 at 12:13, Mike Leone eloquently inscribed:

[Mayo, Bill]

You can. You have to kill explorer, go to task manager, choose run new task, enter "explorer.exe /nouaccheck", and tick the "run as administrator" button. Not that you should do that on the regular.

-----Original Message-----
From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> On Behalf Of Hammer, Erich F
Sent: Monday, June 29, 2026 1:29 PM
To: ntsys...@googlegroups.com
Subject: RE: [ntsysadmin] Confused about NTFS permissions and inheritance

EXTERNAL EMAIL: This email originated from outside of Pitt County Government. Do not click any links or open any attachments unless you trust the sender and know the content is safe.

--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/IA3PR04MB9182682372DA79A42F089E4FCCE82%40IA3PR04MB9182.namprd04.prod.outlook.com.

[Philip Elder]

Process Monitor

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

 

The app is making changes, or trying to, that it cannot do within the logon context of the app itself.

 

Find the Access Denied steps that the app is hitting.

 

Usually, it means giving MOD rights to either USERS or a specific user set up with “Run as Service” and given MOD to the needed folders.

 

Philip Elder MCTS

Senior Technical Architect

Microsoft High Availability MVP

MPECS Inc.

E-mail: Phili...@MPECSInc.Ca

Phone: +1 (780) 458-2028

Web: www.MPECSInc.Com

Blog: Blog.MPECSInc.Com  

Twitter: Twitter.com/MPECSInc

 

Please note: Although we may sometimes respond to email, text and phone calls instantly at all hours of the day, our regular business hours are 8:00 AM - 5:00 PM, Monday thru Friday.

--

You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CAHBr%2B%2BhXMR5LKkii%2BxSUWYq3v51F5rFEZsQQu2JHQ0osNH3AAA%40mail.gmail.com.

[Mike Leone]

     

On Mon, Jun 29, 2026, 5:41 PM Philip Elder <Phili...@mpecsinc.ca> wrote:

Process Monitor

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

 

The app is making changes, or trying to, that it cannot do within the logon context of the app itself.

It's not the application. It's the user wanting to edit/modify the file created by the application. 

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/a42f0eda75bb4890a7c464491bdaa807%40MPECSInc.Ca.

[Aakash Shah]

If this is a major problem for the vendor, delegating access to a custom group (and not a built in group) will avoid the need to elevate. On the other hand, if they just run the editor elevated as others have suggested this would solve the problem too.

 

-Aakash Shah

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/SN6PR04MB4766491ADA62E948AFB9895ABCE82%40SN6PR04MB4766.namprd04.prod.outlook.com.