Re: 2003 home folder security problem
From: Dmitry Korolyov [MVP] (d__k_at_removethispart.mail.ru)
Date: 08/09/04
- Next message: pat: "worm plexus.b"
- Previous message: markwell99_at_yahoo.com: "Test Post"
- In reply to: Dan King: "Re: 2003 home folder security problem"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 9 Aug 2004 17:23:46 +0400
Well, in fact for me, cancelling permissions inheritance is what I call a
security fly. With cancelled inheritance, you can forget about permissions
defined at the child level. Then you apply additional (or modify existing)
permissions to the parent container and think that everything is ok. But it
is not, and as a result you may get lots of user complaints, and potential
security problems.
I feel more secure with inherited permissions. They just feel more
consistent this way. And note also that there are very very very rare cases
when a certain security scheme cannot be implemented without cancelling
inheritance at container levels. Both NTFS and AD security models allow you
to manipulate permissions very precisely, and you can do almost everything
with this model - without cancelling inheritance.
-- Dmitry Korolyov [d__k@removethispart.mail.ru] MVP: Windows Server - Active Directory "Dan King" <danking65@earthlink.net> wrote in message news:uGY70o8eEHA.4068@TK2MSFTNGP11.phx.gbl... Thanks for the response Dmitry, When creating a users home folder ADUC does not ask if you want to grant full rights, unless the folder already exists. In which case, it still does not prevent inheritance from the parent. Your second point about applying rights only to the parent folder is a good one. It just seems to me that by allowing permissions to be inherited by default could be a potential security hole. If rights get applied incorrectly at the parent folder, you could open up access to very private/confidential information. Dan
- Next message: pat: "worm plexus.b"
- Previous message: markwell99_at_yahoo.com: "Test Post"
- In reply to: Dan King: "Re: 2003 home folder security problem"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
