Win2K Admin Question

[FreshPrince]

I accidetally removed "change permission" right to a folder from my admin account. Now I can't set permissions to anything in and under that folder. What can I do to fix this problem?

and yes, I did a stoopid thing

 

[Agamar]

Try taking ownership of the file/directory.

 

[bsobel]

Originally posted by: Agamar
Try taking ownership of the file/directory.

Yep, that should fix it.
Bill

 

[FreshPrince]

I can't do that because the box is unchecked for my admin ID

 

[Saltin]

I can't do that because the box is unchecked for my admin ID

An admin can always take ownership of files/folders. No exceptions. Look in the advanced area on the security tab.

 

[FreshPrince]

Originally posted by: Saltin

I can't do that because the box is unchecked for my admin ID

An admin can always take ownership of files/folders. No exceptions. Look in the advanced area on the security tab.

inside the advance properties window there's a owner tab. When I click on owner, it says I have view only permission.

 

[Saltin]

Try logging in as an admin.

 

[krystalogik]

Sounds like you have limited admin access.

are you logging in as an after the fact admin (i.e. you made this user an admin, it's not the builtin (correct?) admin?)

If yes, try logging in as "Administrator" (unless you renamed that user, which is a good idea.)

 

[stash]

As I believe someone mentioned before in this forum, there is no such thing as a "limited access" admin. You either are or you aren't.

Using the built in administrator account or one you created is irrelevant. As long as an account is a member of the administrators group, its an admin.

The only exception is in an active directory environment. In AD, there are actually two users with more "power" than the familiar domain admin...enterprise administrator, and schema administrator, with the latter being god in an AD forest. So it is possible for a domain admin not to have rights or access across an entire AD namespace.

But it sounds like this is a local admin problem, so the AD exception wouldn't apply.

 

[obenton]

Years ago, when I was playihg with security settings, as above, I found that it is possible to permanently lock yourself out, as you apparently did. If you still have the right to delete the folder, you might try copying it somewhere, hoping that the security settings don't follow, then delete and restore the backup.

 

[FreshPrince]

the admin id is the built in but renamed account. any other suggestions?

 

[Saltin]

It is NOT POSSIBLE to lock a local admin out of any file/folder on his/her computer. If anyone thinks they know a way, please post it here so it can be discussed.

The only exception is in an active directory environment. In AD, there are actually two users with more "power" than the familiar domain admin...enterprise administrator, and schema administrator, with the latter being god in an AD forest

By default, the "domain admin" account is a member of both of these security groups. Of course you could remove this account, and in many large networks this is the case. Nevertheless, a Schema admin (for example) could not lock a domain admin out of a file folder. A domain admin (or a local admin if that is where the file/folder is located) can ALWAYS take ownership.

 

[krystalogik]

Originally posted by: STaSh
As I believe someone mentioned before in this forum, there is no such thing as a "limited access" admin. You either are or you aren't.

Using the built in administrator account or one you created is irrelevant. As long as an account is a member of the administrators group, its an admin.

The only exception is in an active directory environment. In AD, there are actually two users with more "power" than the familiar domain admin...enterprise administrator, and schema administrator, with the latter being god in an AD forest. So it is possible for a domain admin not to have rights or access across an entire AD namespace.

But it sounds like this is a local admin problem, so the AD exception wouldn't apply.

I was, of course, speaking of the AD application of a limited admin, as he hadnt made it clear( at least to me) that this was a local situation.

 

[krystalogik]

woops. sorry double post, so i'll try to make it helpful.

can you check the box that's unchecked?

 

[FreshPrince]

ok, to make it absolutely clear so that there's no misconceptions and someone can ACTUALLY help...here's the setup.

The admin ID I'm using is the builtin ID..which is a member to all the major groups...local administrators...enterprise admin...exchange enterprise admin...blah blah blah blah blah...

and yes, it's setup in AD...obviously it's AD...DUH! you can't have exchange 2000 w/o AD....obviously....anyways

If you don't know wut you're talking then dun contribute....J/K! well...maybe not

no I can't check the damn box...if I could it would all be solved...as I explained earlier....no, if I check the box, it still says I don't have permission to change anything. I can go into exchange admin mmc and see the delegate control setting for this ID...it's set to full control. The backup admin ID I created after the fact also has full control. So I go into everywhere else that's connected to public folders and check the security tab...it all says my builtin id has full control to public folder...cept one location: "M:\domain_name\public folders" if I check the properties for this folder...it shows that all the accounts assigned rights to it. However, when I click on an account to see what right are given, it show all the boxes unchecked. so I check all other IDs and they all are the same way. THen I clicked on advanced and it shows different story...it shows that all the IDs have read, write and execute checked...but not take ownership, change permissions, or full control. so I go even further and edit each individual ID inside the advanced window. here, I check all the boxes that I want and then hit apply. It come up and says the Network request is unavailable...wtf. So I go into the ower tab thinking I can take ownership...um no, it says I only have rights to view ownership...not change it. It also shows that no IDs have ownership. If I do the same thing for another folder, it shows that this admin ID is the owner. I even checked IIS, public folders and unchecked the SSL requirements..thinking it would do something...no luck. So wut in the blue h3ll is going on? Everywhere I look, my ID has full control except the properties for that folder in M: drive. This lil bug is causing all kinds of hell...

1st I can't set permissions anymore in outlook as admin. in outlook, signed in as admin, if I right click on a public folder...the permissions tab is gone...it used to be there. I tried to delete all the folders and recreate them...no luck, it won't let me delete.

2nd I can't backup the public folders anymore..backupexec says I don't have permissions...well duh!

How in the world can it be that the child permissions be higher in command than parent properties? I had the same problem with my mailbox rights...at one point, admin didn't have rights to any mbox...which caused all kinds of hell including backups. I fixed it by unchecking the "propagate from parent" box so that I could remove all the implicit denys....wut ever M$

this however is not the case for public folders...because when I do that it still comes back telling my I don't have rights to do that for this folder...I guess ya need owership to the folder to change any permissions...well duh! but how?!

I refuse to pay m$ $195 per incident...cuz that's retarded...we already paid $8000+ for exchange server + licenses...why in h3ll should pay another $195 to get support? Anyways, I tried the free online support but it wants my product ID...well, where can you find that? and no, it's not the CD key..already tried it. in the old days you can open up a M$ app and go to help...about product to find the product ID. Not this one though...everything is using MMC and it doesn't have this option. If I can find the product ID...atleast I can try the free support and have them escalate to level II or III...this usually helps.

anyways..sorry for the long rant <== extremely frustrated. if anyone has any other ideas...please respond...or if you know where I can look to get the exchange 2000 server product ID for my server...I would appreciate it.

- FP

 

[stash]

and yes, it's setup in AD...obviously it's AD...DUH! you can't have exchange 2000 w/o AD....obviously....anyways

I am well aware that you cant have Exchange 2000 w/o AD...however, nowhere in this post do I see "exchange 2000"...hmmmmm

Anyway, I dont know how to fix your problem...I think at this point it would be easiest if I could actually see the way things were set up. And I will try not to be insulted at your comment above, and chalk it up to your frustration.

 

[FreshPrince]

Originally posted by: STaSh

and yes, it's setup in AD...obviously it's AD...DUH! you can't have exchange 2000 w/o AD....obviously....anyways

I am well aware that you cant have Exchange 2000 w/o AD...however, nowhere in this post do I see "exchange 2000"...hmmmmm

Anyway, I dont know how to fix your problem...I think at this point it would be easiest if I could actually see the way things were set up. And I will try not to be insulted at your comment above, and chalk it up to your frustration.

LOL I knew I forgot to include a key piece of information...DOH!

sorry, didn't mean to rant

 

[Saltin]

cept one location: "M:\domain_name\public folders"

You should have said that a long time ago, dude. That's default behaviour.
You could likely use pfadmin.exe or something to modify these permissions, but you don't want to do that.
Public folder permissions are best assigned from Outlook during creation (assuming it's the default MAPI public folder root).

There are certain areas of an Exchange 2000 install that MS decided no-one needed easy access to. This is b/c they are complicated and easy to break. This is also becuase Exchange is a messaging system, and Admin's don't need/shouldnt have full control of all the information (by default anyhow).
A simple search in MS help and support would start you on the path to figuring out your issue, although it's beyond me why you would want to change this.

 

[lowtech1]

It is possible to lock yourself out of Windows if you log in and fuge around with the registry, and it is even easier to screw yourself in Netware. (personally have had heart burns from recovering broken Domain SID/ACL)

For the above reasone & convenience MS tried to copy (haft-ass WinXP) Unix & Linux shell swapping idea to admin the system.

 

[Saltin]

It is possible to lock yourself out of Windows if you log in and fuge around with the registry, and it is even easier to screw yourself in Netware. (personally have had heart burns from recovering broken Domain SID/ACL)

We arent talking about locking yourself out of Windows. Any dummy can do that.

 

[mmcwiz]

Saltin is right about not messing with the directory permissions on Public Folders, but if you need to administer the PF (ie add users, change perms) and you have some how locked yourself out this is how you can fix it. Open "Exchange System Manager" as the Exchange admin or a member of the Domain admins group. Open "Administrative Groups" then open the administrative group in which the PF is located. Then open "Folders" then open "Public Folders". Right click on the target PF and choose "Properties". Click on the "Permissions" tab and you will see three choices "Client permissions", "Directory rights", and "Administrative rights". You want to select "Client permissions". Add yourself as "owner" or "publishing editor". After doing this you will be able to administrate that PF.