Re: c:\ drive permissions

• Previous message: S. Pidgorny : "Re: OS Fingerprinting Prevention"
• In reply to: Nathan: "c:\ drive permissions"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Fri, 24 Jun 2005 23:34:38 -0700

I really, really hope you have found someone to whom they can relate
that is willing to tell them what a very, totally dumb idea that was.

The default permissions on XP are highly varied, and are best rest by
application of a template used in install, either as Steve points out or
the filesystem section of "setup security.inf" or even defaultwk.inf.

What you will need to address is why they found the path of least effort
(grant Everyone Full) needed. This is likely because they were having
problems with some applications running with the default NFTS settings.
Oftern adjustment so Users group will have change on the application's
installation folder is sufficient, while at others one also must adjust the
applications keys in the registry (and sometimes other deltas need to
be used)

While I referred to it as a really dumb idea, it is in fact just making
XP NTFS act like the client machines were still Win9x, so it is not
as though they had been without example.

-- 
Roger Abell
Microsoft MVP (Windows Server: Security)
MCDBA,  MCSE W2k3+W2k+Nt4
"Nathan" <caseynathan@hotmail.com> wrote in message 
news:e1IyjEFeFHA.796@TK2MSFTNGP09.phx.gbl...
> The Desktop team in our department has been deploying PC's with the C:\ 
> drive
> permissions changed. They thought it would be convenient for the user if
> everyone had full control of the entire c:\ drive.
> I now need to return the c:\ drive permissions back to winxp standard. If 
> I
> go the advances security tab for the c:\ drive and edit the permissions 
> for
> the "everyone" group and change the "Everyone" permission to:
> Traverse Folder / Execute File
> List folder / Read Data
> Read Attributes
> Read Extended Attributes
> Read Permissions
> I then Select "This Folder Only" in the "Apply onto" drop down menu.
> Now the sub directories now longer inherit the "everyone" group 
> permissions.
>
> Since I need this done on several hundred PC's I have been testing
> subinacl.exe
> I ran the following command on a fresh winxp install to get a backup of 
> the
> default c:\ drive permissions:
> subinacl /noverbose /output=c:\aclbackups.txt /file c:\
>
> I then ran "subinacl /playfile c:\aclbackups.txt" on a PC that had the c:\
> permissions changed.
> The command changed the c:\ permissions back to base winxp c:\ drive
> permissions but the sub folders still had inherited the "everyone" group 
> full
> control. On the advanced permissions tab of a sub directory the "Inherited
> From" section showed "Parent Object" instead of "C:\"
>
> Any ideas on how I can change the C:\ drive and sub directories back to
> winxp base permissions would be greatly appreciated.
> Thanks
> Nathan
>
>
> 

• Previous message: S. Pidgorny : "Re: OS Fingerprinting Prevention"
• In reply to: Nathan: "c:\ drive permissions"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]