Filtered articles: "Permission"

Filtered articles: "Permission"
Q&A: How to Modify Permissions on Administrative Shares

Question by reader Kendra:

I stumbled upon your blog/profile while I was looking for options to lockdown my administrative shares. Maybe you can help me. I'm a Network Administrator for an aerospace / engineering firm where users need administrative access to their PCs. The engineers work on very high-level OS and hardware development and need complete control of their systems. As you can imagine this poses a huge security problems for me at the network level. Currently my users are granted local administrator rights via an AD group (Local Admins) which is added to the local Administrators group on their local PCs. This makes it convenient for my engineers to login to any PC in the company and have local admin rights to do whatever they need to do. This also gives all of my users access to each other's administrative shares across the network. For example, anyone in this AD group can run \\computername\c$ and access any PC on my domain. I do NOT want to disable administrative shares as I am using them to automatically deploy desktop configuration settings (email, mapped network drives, printers, etc). Do you know of a way that I can give my engineers local admin rights without giving them rights to each other's administrative shares? Any help would be greatly appreciated.
Bild von helge
Free Script: User Profile Domain Migration with SetACL

When administrators migrate user accounts between domains, they typically re-ACL those server ressources users have access to. In plain English: they copy or move the permissions from the accounts of the old domain to the corresponding accounts of the new domain. There are various ways to do that. In this article, I present a simple way to re-ACL roaming user profiles.
Bild von helge
How to Modify Default Share Permissions and Other Tweaks

NTFS permissions are stored in the file system, that is well known. But where are share permissions stored?

As so often with Windows: in the registry. Network shares are defined by only a handful of relatively simple registry entries stored in the server service's key which is, for historical reasons that go back way beyond OS/2, named "LanmanServer" (the workstation service is similarly named "LanmanWorkstation").

The share definitions can be found here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Shares
Bild von helge
Hard Links and Permissions / ACLs

Commenter Lee asked how ACLs are evaluated when an object has multiple hard links. I replied with comments of my own, which turned out to be wrong after I did some experiments. Here is what I found out about hard link permissions and believe to be true.
Bild von helge
Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained
Published by Helge Klein on 03/13/2009 | 5 Comments | 10,901 Views

Every object that can have an security descriptor (SD) is a securable object that may be protected by permissions. All named and several unnamed Windows objects are securable and can have SDs, although this is not widely known. There does not even exist a GUI for manipulating the SDs of many object types! Have you ever tried to kill a system process in Task Manager and got the message "Access denied"? This is due to the fact that this process' SD does not allow even administrators to kill the process. But it is, of course, possible, as an administrator, to obtain the necessary permissions, provided a GUI or some other tool is available.
Bild von helge
How to Prevent Users from Changing Permissions on File Servers

On file servers in corporate environments one typically does not want users to change permissions, even on their own files. It might seem that it would be sufficient to simply grant change permissions instead of full control, but unfortunately that is not the case. The problem is that whenever a new file gets created, the user creating the file will be its owner. And owners can always change permissions, regardless of the contents of the DACL.
Bild von helge

Most Viewed Posts
154,887 Views
Where is the Hosts File on Windows x64?
by Helge Klein (06/04/2009)
82,963 Views
Deleting a Local User Profile - Not as easy as one Might Assume
by Helge Klein (10/16/2008)
53,019 Views
Printer Driver Isolation in Windows 7 and Server 2008 R2
by Helge Klein (04/08/2009)
44,217 Views
How to Reduce the Size of Roaming Profiles
by Helge Klein (11/17/2008)
32,101 Views
Aufbau einer KMS Infrastruktur
by Thorsten Christoffers (03/19/2009)
sepago @ facebook sepago @ twitter sepago newsfeed