I created a local user for a Windows Server 2019 system and was reviewing the permissions on a folder. The ACL contained many former employees, so I removed those outdated entries. Afterward, users who previously accessed the files through a service account could no longer see or open them. I checked Active Directory and the users still appear to be listed as members associated with that service account, but access has not returned. What should I check or restore?
3 Answers
Be careful with the terminology here: a service account normally isn’t a container for users. If this is actually a security group in Active Directory, verify that the group still exists, that the expected users are members, and that the group itself is assigned to the folder. Also inspect subfolders for permissions that were assigned directly to individual users instead of inherited from the parent.
Start by checking the folder’s Advanced Security Settings and confirm that the service account—or the security group it belongs to—still has an Allow entry. It’s possible the account’s access control entry was removed along with the former employees. Also check whether inheritance was disabled or whether child permissions were replaced. Use Effective Access for the service account to see exactly what permissions are being granted or denied.
Remember that share permissions and NTFS permissions are separate. Check both the Sharing permissions and the Security tab—the more restrictive result wins. If the intended access comes from a group, restore that group to the folder ACL rather than adding individual users. After correcting group membership, affected users may need to sign out and back in so their access tokens refresh.
Thanks for the detailed checklist. I’ll go through those settings when I’m back at work. I was really worried about this when I left yesterday.