What I have here is just a single Windows 2008 R2 server in its own domain, a couple of users and computers - nothing complicated.
So I created some users, groups and a few share, joined the computers to the domain and so far so good.
I chose permissive Share permission but restricting access by using NTFS permission.
Big problem now is, some of my normal users somehow is getting full permission to every share every folders, just like a administrator! If I check at the server console, folder properties effective permission show those users have no rights; but on their computer, effective permission show they have full control.
I have checked the share & folders permission, users membership to groups and all seems ok.
Please tell me what else can I check. I can't believe Windows security is like this.