I noticed a strange thing today.

We have to completely separate Windows 2000 forests. I have an account in
both of them. In forest A, my account has Domain Administrator rights, in B,
it has just normal User rights. They both have the same password

Logged into B i tried to access the C$ share of the domain controller in A.
Because im logged in using an account with only "user" rights, access should
be denied, but guess what......the share appeared and all the files on the C
Drive were present. ie Administrator Access

How is this possible?????? Surely Windows authentication analyses the
account SID when granting permissions and not just the username!

Help!!!!

Your username and password when accessing forest B objects will have
separate rights from your username and password when accessing forest A
objects ... The behavior you are seeing is correct ...

"Jeff" wrote in message
news:uB3rVyTnDHA.2528@TK2MSFTNGP12.phx.gbl...
>
> I noticed a strange thing today.
>
> We have to completely separate Windows 2000 forests. I have an account in
> both of them. In forest A, my account has Domain Administrator rights, in
B,
> it has just normal User rights. They both have the same password
>
> Logged into B i tried to access the C$ share of the domain controller in
A.
> Because im logged in using an account with only "user" rights, access
should
> be denied, but guess what......the share appeared and all the files on the
C
> Drive were present. ie Administrator Access
>
> How is this possible?????? Surely Windows authentication analyses the
> account SID when granting permissions and not just the username!
>
> Help!!!!
>
>