Windows Forum

Ask something
Discussion Locked

NT Security Issue

0 helpful
9 replies

by aspiring_one

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

On one of our shared drives, someone has created a directory and locked its permissions in such a way that the domain administrator can't view the permissions or take ownership of the directory to get rid of it.

We have a Windows NT 4.0 network.Is there some type of third-party file permission utility that is making this possible? Perhaps an add-on for NT 4.0 that is native with Windows 2000? I didn't think it was possible to deny the take ownership right away from a domain administrator.

Help!

9 replies

by avachon

Hi, I noticed you said domain administrator and not local administrator. It is possible (and under some conditions advisable) to remove the local administrator from domain administrators). Double-check to see if the person has local admin rights andthen try taking ownership of the directory. Hope this helps.

by bill cassada

The local administrator can take ownership of ANYTHING on that machine. Get someone to log in locally and take ownership, then set the permissions properly so the user can't do this again.

by dlw6

Another possibility is that the person who created this directory set Domain Admins as NO ACCESS. Permissions are cumulative (the more groups you're a member of, the more permissions you may have) except for No Access, which trumps all others. I have heard that it is possible to lock yourself out this way, though I've never tried it.

lvachon is correct as well, in that someone may have taken the Domain Admins group (global group) out of the Administrators group (local group) on that machine.

Either way, you'll have to log into the machine with the shared folder.

Good luck,
Don

by slora

The directory could also have a corrupted security descriptor. You could run a chkdsk /r on the drive to rule out this possibility.

This discussion is closed to new replies.