Re: File System Security Setting Causes Slow Logon
From: BlenderStyle (BlenderStyle_at_discussions.microsoft.com)
Date: 11/18/05
- Next message: Roger Abell [MVP]: "Re: Allowing access to admin$ on NT4 -- getting "Access is Denied""
- Previous message: Guillaume Tamboise: "802.1X supplicant & server authentication & registry"
- In reply to: Roger Abell [MVP]: "Re: File System Security Setting Causes Slow Logon"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 17 Nov 2005 16:15:02 -0800
That's exactly what I did and it worked! I created an OU called WinXP and a
sub-OU called WinXP_FS where I applied the File System Security Policy. I
just move a machine to the WinXP_FS OU, reboot it, wait for the NTFS
permissions to change and for winlogon.log to report it's finished and then I
move the machine up a level to WinXP to stop recieving the File System
Security Policy. As far as I can tell this has been an excellent solution for
my problem. Thanks, Roger and Karl for your help.
By the way, in my File System Security Policy I also define registry
permissions. This solution works well for that too. One thing, this doesn't
work for the root of the file system (C:\) so keep that in mind if any of you
are doing this.
"Roger Abell [MVP]" wrote:
> You may find that a better approach would be such as use of a temp
> sub-OU with GPO that carries the file system permissioning.
> IMO the intent of filesystem ACLs in GPO is for only the very important
> storage areas for which you have need to guarantee the DACL/SACL
> will be just so, and if changed locally will again become just so.
> You are likely seeing the occassional slow login because the GPO that
> carries the filesystem ACLing is seen to have a new version number,
> and so it gets pulled from the DC and reapplied.
> Moving a machine to which filesystem ACLing has been applied in this
> way out from under the scope of the applying GPO will not result in
> the ACLing reverting. It gets imprinted into the filesystem, unlike GPO
> based Security Settings for which the "Policy" reg keys are defined to
> allow avoidance of the imprinting effect. Hence, the opening suggesting
> of a temp sub-OU used just to set the ACLing, so that in its normal
> state (OU location) the occassional slowdown is not seen, again,
> assuming your objective is not to enforce guarantee of just so.
>
> --
> Roger Abell
> Microsoft MVP (Windows Server : Security)
> MCDBA, MCSE W2k3+W2k+Nt4
> "BlenderStyle" <BlenderStyle@discussions.microsoft.com> wrote in message
> news:5C619F11-B405-46F4-96A5-78A5489B872A@microsoft.com...
> > I'm using a group policy object that sets Computer Configuration\Windows
> > Settings\Security Settings\File System. I use this because there were some
> > problems with applications not working without write access to certain
> > folders (including the Windows folders). I wanted to set the permissions
> > on
> > several machines at once so I put them all in an Organizational Unit,
> > applied
> > my Group Policy, and rebooted the machines. They took a long time to login
> > (because it was setting the new NTFS permissions) but it worked. They
> > logged
> > in again and it was normal speed. Now for the problem.
> >
> > Every so often when someone logs on to one of these machines it will take
> > a
> > long time to logon. This doesn't happen all the time, just occasionally.
> > I'm
> > assuming the cached settings on the machine need to be updated from the
> > domain so it reapplies the settings, thus reapplying the new NTFS
> > permissions.
> >
> > Is there another Group Policy setting that will override this? If I move
> > these machines to a different OU without File System Security Settings
> > will
> > it keep the settings applied by my GPO even though it's no longer being
> > applied? Is there a better way to set a bunch of NTFS permissions on
> > remote
> > machines?
>
>
>
- Next message: Roger Abell [MVP]: "Re: Allowing access to admin$ on NT4 -- getting "Access is Denied""
- Previous message: Guillaume Tamboise: "802.1X supplicant & server authentication & registry"
- In reply to: Roger Abell [MVP]: "Re: File System Security Setting Causes Slow Logon"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
