RE: DACLS for software distribution points...

Actually, in a default Windows Server 2003 *domain*, the Everyone group does
not include the Anonymous Logon account. Has nothing to do with standalone.

Therefore, not a "minor" quibble, considering it's the *default*.

Laura

-----Original Message-----
From: Devin Ganger [mailto:DevinG@xxxxxxxxxx]
Sent: Monday, July 10, 2006 1:41 PM
To: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]; Murad Talukdar
Cc: focus-ms@xxxxxxxxxxxxxxxxx
Subject: RE: DACLS for software distribution points...

At Thursday, July 06, 2006 5:38 PM, Susan Bradley, CPA aka
Ebitz - SBS Rocks [MVP] wrote:

In the 2k3 era the Everyone group is akin to the
Authenticated users
anyway since Everyone in the 2k3 era does not include the
anon users.

A minor quibble, since several folks have now all made this
same statement.

Windows XP and Windows Server 2003 do not include the
Anonymous SID in the Everyone group membership *out of the
box* when in standlone mode.
However, this behavior can be configured through Group Policy
or registry, so you can't just assume that this is the case.

Those of you who doubt this are welcome to refer to KB 278259
for details or read up on the "Network access: Let Everyone
permissions apply to anonymous users" Group Policy setting in
Chapter 5 of the Threats and Countermeasures Guide, which you
can find online at:

http://www.microsoft.com/technet/security/topics/serversecurit
y/tcg/tcgc
h05n.mspx

--
Devin L. Ganger Email: deving@xxxxxxxxxx
3Sharp LLC Phone: 425.882.1032 x 109
15311 NE 90th Street Cell: 425.239.2575
Redmond, WA 98052 Fax: 425.702.8455
(e)Mail Insecurity: http://blogs.3sharp.com/blog/deving/

--------------------------------------------------------------
-------------
--------------------------------------------------------------
-------------



---------------------------------------------------------------------------
---------------------------------------------------------------------------

Relevant Pages

  • Applying User Configuration policies to non-administrators on Win2K3
    ... I created a test OU with three machines: Windows XP SP2, Windows Server ... Desktop Users group logs in via Remote Desktop, ... I put the user in the local administrators group, ... Running the scenario through the Group Policy ...
    (microsoft.public.windows.group_policy)
  • RE: Domain Policy and GPO Resources
    ... There are a lot of technical resources on Microsoft web site. ... In Windows Server 2003 Group Policy center in TechNet, ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • RE: Do I need 2003 R2?
    ... Since the Group Policy editor is a built-in component of Windows Server ... defined Group Policy settings with Group Policy Preference. ... system to fully utilize the Group Policy Preference settings. ...
    (microsoft.public.windows.server.migration)
  • Re: Applying User Configuration policies to non-administrators on Win2K3
    ... computer and W2003 server are shown as being in the same container in Active ... domain/OU Group Policy be local computer groups. ... administrators group does which would not be a default configuration. ... > I created a test OU with three machines: Windows XP SP2, Windows Server ...
    (microsoft.public.windows.group_policy)
  • Re: Security options dont appear when editing from DC
    ... This option is listed only in Windows Server 2003 or XP management console, ... then do this at domain Controllers Group Policy. ... > i'm trying to disable LM Hash storing on my domain controller. ...
    (microsoft.public.win2000.active_directory)