Server 2016: Accessing non-OS disk: "Access Denied"

Question

Hi Folks,

I have built and patched a vanilla Windows Server 2016 Standard and joined it to our domain.

The server has a second, large disk, D:, which was accessible before the server joined the domain.

The disk's NTFS ownership is Local Admins.

Domain Admins and Local Admins have Full NTFS Rights from the root.

Now, logged in as a Domain Admin, if I try to open the disk from Windows explorer, I get "D:\ is not accessible. Access Denied".

If I open a command prompt and try to change to the D: drive, I get the same message.

I can open the C: drive without issue.

If I open the command prompt with elevated privileges, I can change to and browse the disk, but if I try to launch explorer from this prompt or try to launch explorer with elevated privileges from the Windows folder, I still get "Access Denied"

If I use a 3rd party file explorer, such as Explorer++ and run it with elevated privs, I can access the disk.

There are a couple of shared folders under the root of the drive, with Everyone:r/w access. If I try to connect to the share from this server using Windows Explorer, I get "Windows cannot access \{server}{share}. You do not have permission to access \{server}{share}..."

If I connect to the same share from another server in the domain, using the same credentials, I can connect.

UAC is off and there are no logged events associated with the failed access.

It's gotta be a security setting and I'm still digging, but if anyone has any thoughts on why Windows Explorer is behaving like this, I'd welcome the feedback.

Answer 1

I finally found a fix for me:

"https://www.ryadel.com/en/windows-users-administrators-group-without-admin-rights-uac-fix/"

Launch gpedit from an elevated command prompt.
Navigate to Computer Settings\Windows settings\Security settings\Local policies\Security options
Locate the following policy:  User Account Control: Run all administrators in Admin Approval Mode, which you’ll find Enabled.
Set it to Disabled.

Maybe it helps you...