Home / server / Questions / 75691
Accepted
Nic
Asked: 2009-10-19 10:59:43 +0800 CST

Why can't I browse my D: drive, even if I'm in the Administrators group?

  • 772

My fileserver running Windows Server 2008 has two logical drives; the C: drive contains all of the system and application data, and the D: drive contains all of the business data. There are several shares on the top level of the D: drive that are working fine. However...

When logged into the fileserver interactively via Remote Desktop, only the Domain Administrator and local Administrator accounts can browse the D: drive. I set up an account called "Maintenance" and added it to the local Administrators group, but when logged in with this user, I can't browse into the D: drive. The D: drive has the following permissions ACL:

Full Access - SYSTEM
Full Access - MACHINE\Administrators

It won't even let me view the ACL for the E: drive. So I tried taking ownership of the E: drive, then I can read the ACL, and "Effective Permissions" says that I have full access. But I still get this error message.

Location is not available
D:\ is not accessible.
Access is denied.
windows-server-2008

2 Answers

  1. Best Answer

    Sounds like UAC to me and access to the drive requires elevation - what happens if you run a cmd shell as Administrator (while running as your Maintenance account)? Can you see the contents of the drive then? Local Administrator and Domain Admins are automatically elevated when needed under 2008 by default, I don't think mere members of the administrators account are.

    Edited to add:

    You can modify this behaviour by Group Policy however bear in mind that the default is set that way intentionally - the specific policy you want to change is "User Account Control: Run all administrators in Admin Approval Mode" - you can find details on how to do this in this MSDN article.

    • 9

  2. http://technet.microsoft.com/en-us/library/cc731677(WS.10).aspx

    Changes to tokens When a user who is a member of the Administrators group in Windows® XP or Windows Server 2003 logs on to a computer, that user's token contains the Administrators group SID, and the user has the same permission as the Administrators group. In Windows Server 2008 and Windows Vista, if UAC is enabled, the Administrators SID is still present in the token but is set to Deny only. When performing access control, such an entry in the token is used only to deny access—in other words, to match Deny ACEs. Any Allow ACEs for that SID are ignored. That means that you are not truly an administrator all the time, even if you log on to the computer as one.

    • 0