Server Operators Cannot View Administrative Shares in NT

3.50 3.51 WINDOWS

The information in this article applies to:

• Microsoft Windows NT Workstation versions 3.5 and 3.51
• Microsoft Windows NT Server versions 3.5 and 3.51

SYMPTOMS

In Windows NT versions 3.5 and 3.51, if you try to connect to an administrative share as a regular domain user without any special privileges, you will receive the following error:

   Access is Denied.

In Windows NT version 3.51, if you try to connect to an administrative share as a member of the Server Operators group, you will be able to connect to the share and a drive will be mapped to the share in file manager but you will not have access to the share. The left side of the screen in File Manager will show the path to the administrative share and the right side which, usually displays the available files will show:

   You do not have permission to access this directory.

CAUSE

On page 471 of the System Guide, C$ and ADMIN$ shares are discussed. The guide says that only members of the Administrators, Backup Operators, and Server Operators groups can connect to these shares.

The documentation is correct in saying that these users can connect to these shares but fails to elaborate that the Server Operators members can not access the files in these shares. The access to the administrative shares has been minimized by default to make the network more secure. Backup Operators retain permission to access files in these administrative shares, based on the assumption that backing up the data in these administrative shares is a critical function.

WORKAROUND

To work around this problem, complete the following steps:

1. Log on as an administrator.

   Operators permissions to.

   Enter the share name, path, and comment.

   grant its members full control. Remove the group Everyone.