Don't Administrators have access to everything?

[John W.]

There are two Administrator accounts on my XP Pro system, and I recently
added a Limited user. All of the files I had been using were in the Shared
Documents folder, which the Limited users get access to. I didn't want them
to have access to some folders, so I moved those to another folder under C:\
and made sure both Administrator users had Full Control access to the folders
and files. (Simple File Sharing was turned off long ago.) One of the
Administrators is the Owner of nearly every file that was moved. Now, NO
USER has access to most of the moved files, not even the Administrator who is
listed as their Owner. I can't figure out what is special about the few that
can be opened, but I thought the Administrators group had access to all
files. What gives?

 

[Shenan Stanley]

There are two Administrator accounts on my XP Pro system, and I
recently added a Limited user. All of the files I had been using
were in the Shared Documents folder, which the Limited users get
access to. I didn't want them to have access to some folders, so I
moved those to another folder under C:\ and made sure both
Administrator users had Full Control access to the folders and
files. (Simple File Sharing was turned off long ago.) One of the
Administrators is the Owner of nearly every file that was moved.
Now, NO USER has access to most of the moved files, not even the
Administrator who is listed as their Owner. I can't figure out
what is special about the few that can be opened, but I thought the
Administrators group had access to all files. What gives?

Look into taking ownership of the files.

 

[~BD~]

Look here, John http://support.microsoft.com/kB/308421

Btw - I cheated! I saw Sheenan's answer and Googled for 'taking ownership of files'. The link I've
given you was the first on the 'results' page!

HTH

Dave

PS Thanks Sheenan!

 

[John W.]

I already AM owner! Still, I tried taking ownership again. No luck. Since
when does the owner not have access to the file?

 

[Jim]

I already AM owner! Still, I tried taking ownership again. No luck.
Since
when does the owner not have access to the file?

What are the permissions on these files for the owner/creator?
Jim

 

[John W.]

What are the permissions on these files for the owner/creator?
Jim

Were they encrypted?

If you're an admin and you take ownership, and you replace permissions,
then set permission for Administrators, unless they are encrypted or you
corrupted the OS, you own them and can access them.

Two answers in one...
1) No, the files are not encrypted.
2) Both Administrators were granted Full Control permissions,
as I stated originally. Some files show Owner having Full
Control and others show Owner having only Special Permissions.
3) I vote for the corrupted OS.

And more: When accessing the Advanced security, I get the
message that I don't have permission to _view_ the settings but
I can _change_ them. Now that's wierd.

New clue #1: The owner is (was) a member of both
Administrators and Users. Is the Users restriction maybe overriding
the Admin privilege? Simply taking them out of Users didn't clear
any problems, but if I give Everybody access, I can open the file.
On the one file I worked with, I could then change Users back to
a limited access and still open that file from the Admin account.
This looks like a feasible, although painfully tedious, path to a
solution.

 

[Jim]

Two answers in one...
1) No, the files are not encrypted.
2) Both Administrators were granted Full Control permissions,
as I stated originally. Some files show Owner having Full
Control and others show Owner having only Special Permissions.
3) I vote for the corrupted OS.

And more: When accessing the Advanced security, I get the
message that I don't have permission to _view_ the settings but
I can _change_ them. Now that's wierd.

New clue #1: The owner is (was) a member of both
Administrators and Users. Is the Users restriction maybe overriding
the Admin privilege? Simply taking them out of Users didn't clear
any problems, but if I give Everybody access, I can open the file.
On the one file I worked with, I could then change Users back to
a limited access and still open that file from the Admin account.
This looks like a feasible, although painfully tedious, path to a
solution.

For item 2):
A member of the administrators group should grant the Owner Full Control
over all files. A member of the administrators group can always do this.

Yes, a member of the administrators group who does not have permission to
view the settings can nevertheless set them. This is normal behavior.

Jim

 

[John W.]

RESOLUTION achieved, sort of. After
(1) returning the folders to the Shared Documents folder,
(2) giving Users full control of the folders and files, and
(3) copying the folders back to where I wanted them,
I could edit the permissions to achieve the desired results
(well, almost): The Administrators accounts can access
the files and the Users cannot.

PUZZLE 1: If I MOVE the folders, they end up with
NO owner and no one has access to the files (not
even Administrator), but making a COPY applied
the correct inherited permissions. [Note that this
discovery invalidates one of my earlier contentions,
that "I already AM owner." Also, even though my
account had been granted Full Control, I didn't
actually get full control until I took ownership and
said Yes when asked if I wanted to also have full
control.]

PUZZLE 2: The Limited Account user cannot open
the files, but I really wanted to hide them from even
being seen by that user. I could not find a way to
accomplish that without also messing up the
Owner's and Administrators' permissions.

 

[Jim]

RESOLUTION achieved, sort of. After
(1) returning the folders to the Shared Documents folder,
(2) giving Users full control of the folders and files, and
(3) copying the folders back to where I wanted them,
I could edit the permissions to achieve the desired results
(well, almost): The Administrators accounts can access
the files and the Users cannot.

PUZZLE 1: If I MOVE the folders, they end up with
NO owner and no one has access to the files (not
even Administrator), but making a COPY applied
the correct inherited permissions. [Note that this
discovery invalidates one of my earlier contentions,
that "I already AM owner." Also, even though my
account had been granted Full Control, I didn't
actually get full control until I took ownership and
said Yes when asked if I wanted to also have full
control.]

PUZZLE 2: The Limited Account user cannot open
the files, but I really wanted to hide them from even
being seen by that user. I could not find a way to
accomplish that without also messing up the
Owner's and Administrators' permissions.

For item 2):
A member of the administrators group should grant the Owner Full Control
over all files. A member of the administrators group can always do this.

Yes, a member of the administrators group who does not have permission to
view the settings can nevertheless set them. This is normal behavior.

Jim

Puzzle 1: This may be the expected behaviour.
Puzzle 2: Do not allow limited users to read the folder.
Jim

 

[John W.]

RESOLUTION achieved, sort of. After
(1) returning the folders to the Shared Documents folder,
(2) giving Users full control of the folders and files, and
(3) copying the folders back to where I wanted them,
I could edit the permissions to achieve the desired results
(well, almost): The Administrators accounts can access
the files and the Users cannot.

PUZZLE 1: If I MOVE the folders, they end up with
NO owner and no one has access to the files (not
even Administrator), but making a COPY applied
the correct inherited permissions. [Note that this
discovery invalidates one of my earlier contentions,
that "I already AM owner." Also, even though my
account had been granted Full Control, I didn't
actually get full control until I took ownership and
said Yes when asked if I wanted to also have full
control.]

PUZZLE 2: The Limited Account user cannot open
the files, but I really wanted to hide them from even
being seen by that user. I could not find a way to
accomplish that without also messing up the
Owner's and Administrators' permissions.

Puzzle 1: This may be the expected behaviour.
Puzzle 2: Do not allow limited users to read the folder.
Jim

1: Maybe so, but it doesn't flow logically from
my perspective. I'll let that one go as a MS quirk.
2: I left out the details of everything I tried,
simply summarizing with the statement "without
also messing up the Owner's and Administrators'
permissions." That was the first, and most
obvious, thing I tried. It also prevented me, the
owner, from seeing the files.