[peterdigby]

Hi,
I am the IT support guy at a hospital, and have started noticing that a few user logons have the ability to access all of the folders on the network share. It appears that they have 'Domain Admin.' access. I have checked permissions, and these users do not belong to groups that have been given access to the folder. I have covered what I believe to be the basics (folder permissions, users permissions, group permissions, inheritance, etc) but the IT manager and myself have run out of ideas.
I realise I can add the users that I have noticed to all folders on the network share and expressly deny them access; but this will do nothing to any other users that also have this quirk that I have not picked up on yet.
Is there any area I am not looking at, and is there a way to discover if any other users also have incorrect access without the need of testing every user (about 500 at last count).
The hospital is running Win Server 2003, and the client machines are a mixture of Win 2000 and Win XP.
Any ideas would be gratefully received,
Thanks