As I understand it, if a user creates a folder they become the owner and can control NTFS permissions including removal of inherited permissions granted to Domain Admins.

What is the best approach to prevent Domain Admins from being denied access to network folders? These are some of the approaches I have read about:

1. You shouldn't be trying to prevent users from changing permissions on the folders they create.
2. Schedule a script that takes over ownership of any folders that Domain Admins cannot access (sidebar question: if you change owner does that replace [i.e. remove] the ACE that granted full control to the original owner?).
3. Use a combination of Share permissions change and read) and NTFS permissions (modify) to limit Authenticated Users' ability to change permissions [as described by Helge Klein](http://helgeklein.com/blog/2009/01/how-to-restrict-users-from-changing-permissions-on-file-servers/).