Windows Access Administration and Troubleshooting

01Environment

02Access Matrix

User operations.alice, signed in on client01.

Expected and observed matched at baseline and after the fix: Operations allowed, Finance denied.

03Diagnostic Ladder

Checked in order, from account to permissions, before any change was made.

1. 01Account and authenticationEnabled, not locked, password validOK

   Checked

   Get-ADUser returned Enabled = True, LockedOut = False, PasswordExpired = False. On client01, whoami showed Alice still signed in as northstar\operations.alice.

   Evidence

   Screenshot: account and group diagnosis ↗

   If this had failed

   Disabled or locked account, or expired password: reset or unlock per policy.

2. 02DNS and domain-controller discoveryClient resolves and locates dc01OK

   Checked

   Resolve-DnsName dc01.northstar.test returned 10.0.0.4 from the client.

   Evidence

   Screenshot: failure diagnostics ↗

   If this had failed

   Client not using the DC for DNS, so it can't locate the domain: fix the DNS settings.

3. 03Network and SMB (TCP 445)dc01 reachable on port 445OK

   Checked

   Test-NetConnection dc01.northstar.test -Port 445 returned TcpTestSucceeded = True.

   Evidence

   Screenshot: failure diagnostics ↗

   If this had failed

   Firewall or server service blocking SMB: check the path and the service.

4. 04Security-group membershipAlice in SG_Operations_AccessFault

   Checked

   Get-ADGroupMember SG_Operations_Access, filtered for Alice, returned nothing: IsMember = False.

   Evidence

   Screenshot: account and group diagnosis ↗

   Finding

   The actual cause: Alice was missing from SG_Operations_Access.

5. 05Share and NTFS permissionsGroup granted on the share and the ACLOK

   Checked

   Get-SmbShareAccess showed SG_Operations_Access Allow Read, and icacls showed it with Read & Execute. No direct user entries.

   Evidence

   Screenshot: permissions intact ↗

   If this had failed

   Group missing from the share or the NTFS ACL: restore the group entry, never a direct user grant.

04Timeline

1. 1
   Healthy baseline

   Alice opened \\dc01\Operations and was denied \\dc01\Finance, as designed.

2. 2
   Controlled fault

   I removed Alice from SG_Operations_Access, leaving the account, network, DNS, and permissions unchanged.

3. 3
   Logon refreshed

   Alice signed out and back in, so her token reflected the change.

4. 4
   Access denied

   Reading from \\dc01\Operations now returned "Access is denied."

5. 5
   Five-layer diagnosis

   I checked account, DNS, network, group membership, and permissions in order.

6. 6
   Root cause found

   Layer 4 failed: Alice was no longer in SG_Operations_Access.

7. 7
   Membership restored

   I added Alice back to the group and left share and NTFS permissions untouched.

8. 8
   Sign-out / sign-in

   A fresh logon rebuilt her token with the restored group.

9. 9
   Retest: Allow + Deny

   Operations opened; Finance was still denied.

10. 10
    Closed

    I recorded cause, correction, and validation in the incident record.

05Records

06PowerShell Helper

Checks a user's account state and whether they belong to a required group, the first questions in an access-denied ticket. It only reads from Active Directory and changes nothing, so it is safe to run before any fix.

param(
    [Parameter(Mandatory = $true)]
    [string]$Identity,

    [string]$RequiredGroup = "SG_Operations_Access"
)

try {
    $user = Get-ADUser `
        -Identity $Identity `
        -Properties Enabled, LockedOut, PasswordExpired, MemberOf `
        -ErrorAction Stop

    $groups = @(
        $user.MemberOf |
        ForEach-Object {
            (Get-ADGroup -Identity $_).Name
        } |
        Sort-Object
    )

    $isMember = $groups -contains $RequiredGroup

    [PSCustomObject]@{
        SamAccountName  = $user.SamAccountName
        Enabled         = $user.Enabled
        LockedOut       = $user.LockedOut
        PasswordExpired = $user.PasswordExpired
        RequiredGroup   = $RequiredGroup
        IsMember        = $isMember
        Groups          = if ($groups.Count -gt 0) {
            $groups -join ", "
        }
        else {
            "(none)"
        }
    }
}
catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] {
    Write-Error "Active Directory user '$Identity' was not found."
}
catch {
    Write-Error "Unable to retrieve '$Identity': $($_.Exception.Message)"
}

07Evidence

Lab baseline · 01–05

• Screenshot 01Domain baseline
• Screenshot 02Directory services running
• Screenshot 03Domain DNS resolution
• Screenshot 04Client domain membership
• Screenshot 05Client domain authentication

Failure, fix and verification · 06–12

• Screenshot 06Operations access allowed
• Screenshot 07Finance access denied
• Screenshot 08Failure diagnostics
• Screenshot 09Account and group diagnosis
• Screenshot 10Permissions intact
• Screenshot 11Operations access restored
• Screenshot 12Finance still denied