Given the following situation: An Enterprise/Domain Admin is logged on to a W2k8 server and wants to access a folder, which has an ACE giving Enterprise/Domain Admins full access permissions on this folder and all of its content. Windows requests elevation for this operation and if one confirms, it adds an additional ACE giving the user full access permissions, too. In turn, if one uses a non-administrator account which also full access permissions on the very same folder, it just can access it without elevation prompt and any changes to the ACL. How can I disable the former behaviour? This is extremely annoying as it changes the files requiring an extra backup operation for all files accessed by admins. Furthermore, it totally ruins the inheritance of ACLs in the file systems. Any insights would be appreciated. Best regards, Christoph

As this problem is most probably related to AD admin behaviour, I think it is better to post it in the server forum, which I did: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/b85c7c8a-217c-4901-9037-d2c6a4ec1f34

I notice the issue has been resolved on Server Forum. At this time, I will go ahead to close the thread. If you encounter any issue regarding Windows 7 in the future, welcome to post here. Yes, I have also posted our solution in the Server Forum: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/b85c7c8a-217c-4901-9037-d2c6a4ec1f34

Hi, I notice the issue has been resolved on Server Forum. At this time, I will go ahead to close the thread. If you encounter any issue regarding Windows 7 in the future, welcome to post here. Best Regards, Niki Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I notice the issue has been resolved on Server Forum. At this time, I will go ahead to close the thread. If you encounter any issue regarding Windows 7 in the future, welcome to post here. Yes, I have also posted our solution in the Server Forum: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/b85c7c8a-217c-4901-9037-d2c6a4ec1f34