File permissions issue - You need permission to perform this action

Question

This is a very strange issue related to a dfs replicated folder.

The share in question is shared with "Everyone" with full access and permissions are applied to sub-folders using ACLs. Three groups are applied to each folder (Full access to a file administrators group, Read and execute access to a Read only group and Modify access to a Read/Write group).

All is fine in terms of creating/modifying files for the staff that have Read/Write. The issue occurs when staff that have Read/Write access try to delete a file which shows the dreaded "You need permission to perform this action". This occurs even if the file was created by the user in question. Looking at effective permissions shows the correct level of access for the user in question.

What is even more strange is that usually, staff will access these shares using an RDP session which is where the issue occurs. However, if the share is accessed directly under the same user, the file can be deleted.

My first thought was a permission issue but I'm not convinced of that now as files are able to be deleted under certain circumstances i.e. directly through the UNC path.

Any thoughts would be most welcome.

Answer 1

Hi,

Based on my understanding, the issue only happens when you use the RDP to access the files, right?
If possible, would you please share a screenshot of the ACLs for the Read/Write group on the shared folder?
If you give the Modify access to a Read/Write group only on the sub-folder, the user doesn't have permission to delete files created by other users.

It is suggested to give the group delete subfolders and files permission and test the result again.

If still fails, you may consider disable the UAC temporarily.
If there are any progress, welcome to let us know.

Best Regards.

Answer 2

Thank you for you answer, it is most appreciated.

Yes, you are correct in your understanding that the deletion of files is not possible when on the RDP session, connections direct to the file share allow deletions.

Adding Delete subfolders and files made no difference and still presents the same error upon deletion.

UAC is turned off on the orginating file server.

I have attached below screen shots of the file permissions on the directory and an analysis of the effective permissions for an affected user on the problematic folder.

Answer 3

Also, just for clarity's sake, I thought I would post screens of the permissions from the perspective of the RDP server. Also shown is the message shown with what a test user sees trying to delete a folder/file of their own making.

Thanks

Answer 4

Sorry for the late reply,

I have narrowed this down to an issue with the friendly DNS cname alias for this server.

Accessing this file share through the \server-name\share and \server-ip\share works fine and allows files to be deleted.

Creating a new dns cname alias for the server also allows deletion.

I play to delete the cname alias that has been in use and recreate it later on today.

Strangely, there are 3 DNS cname aliases for this file server which are all working, except the one that's in use....

Answer 5

When I got this error message I asked to my supervisor, he told me that the company just established new policies. So, they set my laptop as a exception for this new policie, after that I could get permissions to copy and create new folder and files in my external ssd(my case).