Windows 7: Membership of local built-in group "Users" -- NTFS permissions

Dear,

Can somebody help me?

My initial admin account (made with the installation of windows7) is Marie.
When I look at the Local Users and Groups snap-in of MMC, she's member of the group administrators but not of the group Users.

BUT
then I made a folder "Test".
I disabled the inheritance.
Then I gave the group Users deny permissions of this folder.
The administrators group I gave full control permissions.

The strange thing is that Marie gets also deny permissions though she's not a member of the local group Users but she's member of the group Administrators.

Can somebody give me an anwser on this problem?

Thanks in advance!!

Kind Regards.

Please post screenshot of permissions. Please post screenshot of users members list and administrators list as well.

In the attachment, you can find the different printscreens.

Admin account name: CV
--> Member of administrators group, but not of the Users group
--> Users group: only deny rechten
--> Administrators group: only allow rechten

CV --> everything is denied


Thanks in advance!!!

Kind Regards,

members of group Users:
-normal users
-authenticated users
-interactive users

You're in group authenticated users and interactive users!! So als in group Users. It's a group in a group

make the folder permissions as follows:
owner: Administrators (not really neccesary)
permissions (not inherited from above, as it is now already)
permissions: Administrators Full Access (already so)

That is it!! So simply remove the Users group from the folder permissions.
Understand? Works?

If a user isn't member of any group in the list... it has NO access

Thank you very much!!

Can I see somewhere which users are member of the groups
-authenticated users
-interactive users

Thanks in advance!!

Understanding the Authenticated Users Group
interactive users group: A group that includes all users that have logged on interactively. Membership is controlled by the operating system. So not scheduled tasks and services and network connections for example.

example:
allow read access to Users group
deny full access to Interactive Users group

now users can read but only when not interactive so to access a file over the network for example.

example 2:
no entry of Users group in the list
allow access to Interactive Users group

users can access folder but only when logged in locally. File access from remote is denied for example.

example 3:
no entry of Users group in the list
allow access to Interactive Users group
deny access to Administrators

Same as example 2 but not admins (standard users).

example 4:
allow access to Interactive Users group
deny access to Users group

Same as example 2 but not standard users (only admins).

Thank you very much!