Windows Prevent users from changing file permissions?

I'm trying to ensure that my users can no longer change file permissions. (I want to make this a cumbersome process that involves filling out paper forms and faxing things... because I can.)

Actually too many people have removed the "Domain Admins" and "System" from the permissions folders, so I can't run file management utilities and whatnot.

 

I just noticed the only folders I do not have access to are the "My Documents" folders on each user's computer that have been "synchronized" with the server. (eewwww server synchronization!!! horrible horrible technology that wastes time, bandwidth, and time.)

Any tips? Do I just go on the individual machines and add "Domain Admins" to their "Documents and Settings" folder?

 

If your users aren't admins, they can't remove admins. Once you've been removed, it takes a physical visit to set things straight unless you can access the user's computer via named pipes (UNC path); '//compyname/c$'.

 

I just tried using the UNC path, and there's one tiny flaw:
I don't have permissions to the folders I'm trying to get access to!

I will go and physically visit, but the scary part is most of these people are no longer here! oops!

 

Who's the owner for the folders you're trying to access? Is it possible to set your user as owner?

 

When you get to the machine, do you have a way to log on as an admin, either through domain or local credentials? Because if not, remind me not to come to lunch tomorrow. You're less fun when you're grumpy.

 

Okay, here's a pretend scenario. Let's say I've got a user named "Joe"

Joe's computer was set up so his "My Documents" folder was changed to \\server\users\joe

So now, when Joe makes a folder in his "My Documents", it doesn't necessarily contain the "Domain Admins" user in the file permissions.

After a few years, Joe's computer breaks, he moves, etc. etc. now we have no Joe, no Joe's computer, but we still have a folder on \\server\users\joe with no "Domain Admins" permissions.

Sounds like a case for "Take Ownership" or something like that, but I'm not positive on what it will do to the shares.

 

That's much easier than what I thought was going on. You can safely take ownership of the files without messing up your shares, as long as you don't explicitly remove anyone's access.