Server Operators Cannot View Administrative Shares in NT

Last reviewed: March 11, 1997
Article ID: Q149523

3.50 3.51 WINDOWS

The information in this article applies to:

  • Microsoft Windows NT Workstation versions 3.5 and 3.51
  • Microsoft Windows NT Server versions 3.5 and 3.51

SYMPTOMS

In Windows NT versions 3.5 and 3.51, if you try to connect to an administrative share as a regular domain user without any special privileges, you will receive the following error:

   Access is Denied.

In Windows NT version 3.5, if you try to connect to an administrative share as a member of the Server Operators group, you will be connected with full control.

In Windows NT version 3.51, if you try to connect to an administrative share as a member of the Server Operators group, you will be able to connect to the share and a drive will be mapped to the share in file manager but you will not have access to the share. The left side of the screen in File Manager will show the path to the administrative share and the right side which, usually displays the available files will show:

   You do not have permission to access this directory.

CAUSE

On page 471 of the System Guide, C$ and ADMIN$ shares are discussed. The guide says that only members of the Administrators, Backup Operators, and Server Operators groups can connect to these shares.

The documentation is correct in saying that these users can connect to these shares but fails to elaborate that the Server Operators members can not access the files in these shares. The access to the administrative shares has been minimized by default to make the network more secure. Backup Operators retain permission to access files in these administrative shares, based on the assumption that backing up the data in these administrative shares is a critical function.

WORKAROUND

To work around this problem, complete the following steps:

  1. Log on as an administrator.
2. Go into File Manager and highlight the share you want to give Server
   Operators permissions to.
3. Choose 'Disk' from the toolbar menu and select 'Share As...' 4. In the Shared Directory dialogue box, select the 'New Share' button.
   Enter the share name, path, and comment.
5. Select the 'Permissions...' button. Add the Server Operators group and
   grant its members full control. Remove the group Everyone.

The Server Operators will now be able to access this share with the share name you specified.


KBCategory: kbdocerr
KBSubcategory: ntdocerr
Additional reference words: prodnt 3.5
Keywords : ntdocerr kbdocerr
Version : 3.50 3.51
Platform : WINDOWS


THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: March 11, 1997
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.