No full control over a shared resource

---

I created my own virtual lab using hyper-v with an internal network switch. Both of them have been assigned a static IP as I don't run an AD yet, network connection works fine as I can ping each computer.
I've created a shared folder using an admin account on one of the Windows operating systems. In advanced sharing, I removed "everyone group" and added "users and administrators groups. I changed permissions of each group to my requirements - the admin group has full control, and the users group read only.
The inheritance is enabled in the security tab. Accessing the shared folder using an administrator account from a local disk C doesn't cause any issue - it has full control permission.

When I try to create a new folder inside the shared folder in the Network tab - I don't have full control. It looks like it accesses it through the admin account, however only in the context of the users group privileges???? When I change users group permissions to full access, everything is working.

I double-checked and the account I try to create a new folder with is an administrator and it belongs to the administrators group.

Once I add that specific account to a share permission tab, everything is working. How is that possible? This account belongs to the administrators group so logically any administrative account should work.

Screens:

Hey @Maciej-Staniec great question, remember that if you are in a workgroup, each workstation has a database of users and passwords that they will maintain. If you need to access shared resources in a workgroup, there must be user accounts on both machines. When you access the shared resource on say computer01 from computer02 then a couple of things to keep in mind:

1 - When you connect to computer01, there must be an account present on computer01 with the appropriate permissions. Computer01 does not trust the user accounts on computer02. This is one of the issues we run into while maintaining user account, passwords and access control in workgroups as it is a decentralized environment.

2- If you want seamless connectivity, then I recommend trying this. On both computers create and administrative user called "Admin," make the password the same thing on BOTH computers (*computer01 and computers02 in my example). Set the local permissions (NTFS) with full control and share permissions to full control. Try this. and tell me if this works for you.

Hi Wes,
I tried to access it from the same computer that I shared the folder, that is I created a shared folder on computer01 and gave the permissions mentioned above to default 'administrators' and 'users' groups. I only used groups to give permissions without specific accounts. I can access and modify the folder from local disk C:\ using computer01 but when I try to access it from a "Network" in the file explorer, I can access the shared folder, but when I try to create a new folder or delete an existing one within that shared folder it denies me saying I have no permission to perform these actions. So I created, a shared folder using the same account which is in administrator groups. It works locally, but doesn't have permissions when I try to edit from the Network context? Am I missing something? If I move this account to some custom created group and gave the same permissions as the default 'administrators' group, it works via Network. Why? 🙄
Sorry, it is messed up a bit. I tried a lot of scenarios.

You do not need to apologize as this is an interesting (although I am sure it's frustrating) it is no problem at all. I would however ask you to try the steps above (even if this might not be your normal workflow), just to see if this is a group permission error. I want to test a basic scenario just to see if it works. You can always delete the "admin" account after. Just a little t-shoot.

@wes-bryan I created new admin accounts using Local Users and Groups. I removed them from the default 'Users' group. I added each newly created admin to the default 'administrators' group.

I added those admin accounts to share permissions, I gave full control over a shared folder to each admin, and it works. I can access the shared folder from both computers. I can access each computer's resources.

However - when I remove these admin accounts from the share permission list and add the default 'administrators' group instead - it stops working. Keep in mind that these admins are in the default 'administrators' group, so they should be able to access the shared folder.
If I add the account to some custom group and set its share permissions, it works. If I add the account to the default 'administrators' group, it stops.

What is more, I don't want to use the default "everyone" group as it isn't my goal. My goal is to have set my desired permissions for each group, so I can throw any account to these groups, instead of assigning each account permissions over and over again.

Is that something you would expect in this case? Maybe I am missing something 😅

Thanks.

My next guess is that there is an inheritance issue. Check to see if you might have a parent/child inheritance issue. Another thing that you can use is the "Effective Access" panel from the Advanced Permissions:

This is a great way to troubleshoot access issues.

@wes-bryan I had to turn off Admin Approval Mode in Local Security Policy. It seems that you can't access shared resources with an administrator belonging to a default "Administrators" group when the UAC is on. The only workaround I found is to add the admin account to a manually created group and give it full access, but it has its flaws. You can't change the ownership of the file unless you change who is allowed to do it in the local security policy.
Any other workarounds? I guess the AD, if you will? 😂

I see what you did there....lol, This is one of the many benefits of a directory service.