From 46a0cb0c7ade0232b04bff35a1d718b1001b62ba Mon Sep 17 00:00:00 2001 From: Raimund Andree Date: Wed, 21 Oct 2026 12:23:15 +0000 Subject: [PATCH] docs(access): say that a local standard user still gets "Access is denied" for a domain user account Get-NTFSEffectiveAccess already falls back to the local authorization manager for a name of this computer when the remote one refuses the caller, which covers every account except a user account of the domain: Windows still answers "Access is denied" for that one case, because the local manager has no domain credentials to resolve it. The cmdlet already writes this as a non-terminating GetEffectiveAccessError and returns no result for the item; nothing in the behavior changes. Docs\Cmdlets\Get-NTFSEffectiveAccess.md gets one more NOTES paragraph, in the style of the neighboring "Before 5.0.0..." paragraphs, saying so and naming the accounts that still get a result (accounts of this computer, and domain groups such as Everyone or Domain Users). Evidence: Tests\Lab\Acceptance-2026-10-10-os-matrix.md, "The probe", row "Local standard user". No code change; Tests\Help.Tests.ps1 (unchanged) already covers the page's synopsis, parameters, examples, and links. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant --- Docs/Cmdlets/Get-NTFSEffectiveAccess.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Docs/Cmdlets/Get-NTFSEffectiveAccess.md b/Docs/Cmdlets/Get-NTFSEffectiveAccess.md index d64e3ca..167c622 100644 --- a/Docs/Cmdlets/Get-NTFSEffectiveAccess.md +++ b/Docs/Cmdlets/Get-NTFSEffectiveAccess.md @@ -190,6 +190,8 @@ Before 5.0.0-rc7, a user who wasn't an administrator got the error "Access is de Before 5.0.0-rc8, the cmdlet returned no access and no error when Windows refused to start the authorization manager for the computer of `-ServerName`, for example for a name of 32,718 characters or more, so that the result looked like an account without any rights. The cmdlet now writes a non-terminating `GetEffectiveAccessError` with the error that Windows reported and returns no result for the item, as it does for every other failure of the calculation. It warns that the result is based on this computer only when it calculated a result; before 5.0.0-rc8, the warning also came before an error when the computer couldn't be reached. +A user who has no domain credentials, such as a local standard user, still gets the error "Access is denied" from Windows when it asks for the effective access of a user account of the domain, also for a name of this computer; the cmdlet writes it as a non-terminating `GetEffectiveAccessError` and returns no result for that item. Accounts of this computer and groups such as `Everyone` or `Domain Users` give a result. + ## RELATED LINKS [Get-NTFSAccess](Get-NTFSAccess.md)