Microsoft Cluster and file permissions changed

[Lidia]

Hi,

I've reinstalled two cluster machines, mantaining the information on the shared disk without changes, except quorum disk. Before this, my customer had 300 file share resources in the Cluster Administrator, I've changed this and I've used the "share subdirectories" option from Administrator. Then, after this I find that in all the folders the permission for the Administrators group in the Domain has been changed to Administrators un the local machine (NTFS security level). If I failover the resources, magically, this permission change to the Administrators local group for the other machine. Anybody knows why?

Also, some folders aren't automatically shared, we need to move the information to another disk and afterwards re-copy the information to the old directory, but then I loss the permissions.

Before the re-installation, both nodes were Domain Controllers, now, the machines are members.

I'm taljing about Windows 2000 Advanced Server SP2.

Thanks in advanced for your replies,
Lidia

 

[xenoncj]

Something to keep in mind. All file shares are created with cluster administrator, not with windows explorer.

-Xen

 

[amante]

> If I failover the resources, magically, this permission change to the Administrators local group for the other machine. Anybody knows why?

The computer's local admin group, has the following well-known SID:

S-1–5-32-544

The SID is composed from:
A revision level of 1
An identifier-authority value of 5 (SECURITY_NT_AUTHORITY)
A first subauthority value of 32 (SECURITY_BUILTIN_DOMAIN_RID)
A second subauthority value of 544 (DOMAIN_ALIAS_RID_ADMINS)

As you can see, the local admin SID doesn't carry the computer's SID, so it's the same everywhere. If you display the NTFS security on node 1, you will see NODE1\Administrators where on node 2 you'll see NODE2\Administrators.

For example the local admin account has the computer SID as its base with the RID of 500 appended to it:

S-1-5-21-13124455-12541255-61235125-500


Imagine two member server C1 and C2.
It is not possible (well it is, but not via GUI) to grant C2\Administrator access to a folder in C1. Only domain accounts. It's non sense.

For this reason shared resources must be permissioned against domain accounts or *well-known* accounts (like everyone, system, local admin group, etc).