Monday, February 6, 2012

Windows 2008 R2: Members of the local "Administrator" group do not have admin rights to shares

We have received many reports of a problem with Windows 2008 R2 servers where shares containing the local "Administrator" group were not accessible by members of that group.

For example: we have a GPO that makes our "Domain Admin" group a member of the local Administrator group of all our servers.  However, when a Domain Admin would log onto a server he would not have access to server shares.

We resolved the problem by  disabling User Account Control (UAC) on the server.  This Microsoft KB article describes how to turn UAC off in Server 2008 R2.

For a full overview of UAC and how to turn it off/on on other servers see this KB.

Note: these changes require a restart.

No comments: