Windows admin shares allowing unwanted access for all domain users

Question

My Problem

I have a problem with shares on my Windows 2008 R2 server:

• All shares including administrative shares such as c$ allow all users the permission to create files and folders.

---

My Attempted Fix

I tried to reset permissions on my shares with the icacls tool by doing something like: icacls C:\SHARE /reset

With no any permission, the effective permissions always shows : "Create folder/add data" for all domain account. So, I have tested it with some accounts to confirm that... Yes it works...

---

The icacls output on a share (using icacls C:\SHARE):

C:\SHARE AUTORITE NT\System:(I)(OI)(CI)(F)
     BUILTIN\Administrators:(I)(OI)(CI)(F)
     BUILTIN\Utilisators:(I)(OI)(CI)(RX)
     BUILTIN\Utilisators:(I)(CI)(AD)
     BUILTIN\Users:(I)(CI)(WD)
     CREATEUR PROPRIETAIRE:(I)(OI)(CI)(IO)(F)

I have searched for similar problems but I have found only the opposite.

Clients used are Windows 7.

I'm not sure what to do next to troubleshoot or resolve.

---

Update

It works well on Windows Server 2003 R2 using the same Windows 7 client.

I also tested (on the 2008 R2) with full control and modification for everyone on share permissions and NTFS permissions RX (Read and Execute). But no good results...

Answer 1

All shares including administrative shares as c$ allows all users to create data and create folders.

By default, the local administrators group and the domain admins group (when applicable) are allowed permission to the administrative shares in Windows so see the two below suggestions for what to check group membership wise to see if this is what's causing what you explain.

---

Local Server

Check to ensure the accounts aren't in a local server administrator group on the local server. Check to see what groups the user accounts with the issues are in at this level just in case.

Domain

Check to ensure the accounts aren't in domain administrators group in AD if applicable. Check to see what groups the user accounts with the issue are in from the AD side just in case.