Domain Admins group denied access to d: drive

Question

I have a brand new Active Directory (CORP-AD) installation running on Windows 2008R2. I have a domain controller (PDC01) and a member server (ME01).

The member server has a C: and a D: drive.

Part of our standard build is to remove all permissions from the root of the D: drive except for:

SYSTEM         (Full Control)
Administrators (Full Control)

I created a new domain user ADMIN01 and granted it membership of the Domain Admins group.

Domain Admins is a member of the member server's local Administrators group.

When I logon (via RDP) to the member server ME01 as the domain user ADMIN01 this user cannot access the D: drive. I then tried adding the Domain Admins group with full control to the root of the D: drive but my ADMIN01 user still cannot access the D: drive:

If I logon to ME01 as a local machine administrator I have no trouble accessing the D: drive at all.

I discovered this question which describes more or less the same problem:

Why can't I browse my D: drive, even if I'm in the Administrators group?

The answer suggests correctly that this is a UAC privilege elevation issue but I'm puzzled by this statement, in particular the bold part:

You can modify this behaviour by Group Policy however bear in mind that the default is set that way intentionally - the specific policy you want to change is "User Account Control: Run all administrators in Admin Approval Mode" - you can find details on how to do this in this MSDN article.

Is this suggesting that "User Account Control: Run all administrators in Admin Approval Mode" should not be disabled?

If it's enabled I don't get a UAC challenge with the "Continue" button + shield icon, I'm just plain refused access to the drive. Is this normal?

Solution

The reason, although I don't understand why, seems to be caused by removing the built-in Everyone group from the D: drive permissions.

I've followed this up with a new question:

Why does removing the EVERYONE group prevent domain admins from accessing a drive?

Comments

[Admin]

Your screenshot does not depict the access control entries for the Domain Admins (or Administrators for the matter) security group. You're showing only the ACEs for the SYSTEM built-in account.

[Admin]

@sean - I know the reason now, but I don't understand why: serverfault.com/questions/292663/… - I did mention earlier in the question that SYSTEM, Domain Admins and Administators have full control. The image doesn't really add much I admit.

[Admin]

I am currently grappling with this issue on Server 2012 R2. We have the exact same symptoms you have. Today our domain Admin Group went corrupt and no domain accounts could login to boot. We were forced to remove the server form the domain and re-add it. Once we re added it the drive permission seemed to be resolved.

[Kev]

Nope, it was definitely Administrators, it was me that built the server.

[Kev]

No, the Domain Admins group wasn't removed. Even with Administrators and Domain Admins given full control of d:, my ADMIN01 user can access the drive only if I turn off Run all administrators in Admin Approval Mode . This is a brand new build, nothing else has been touched.

[Kev]

Not just logged off, but rebooted the server too.

[Lucky Luke]

Good question. I'm confused though, in your initial post you only listed only SYSTEM and Administrators as having permissions on the D drive. Was "Everyone" in that list too?

[Kev]

In the above question only SYSTEM and Administrators had permissions on the d: drive.