MS02-064 Root folder permissions

[Sensibilium]

Apologies if this has been asked before, I tried a search but didn't find a thread about it, so here I am.

I'm just about to set my root folder (C security setting according to MS02-064 on my SBS2000 server machine, and these are the settings suggested by Microsoft:

Administrators: Full (This Folder, Subfolder and Files)
Creators Owners: Full (Subfolders and Files)
System: Full (This Folder, Subfolder and Files)
Everyone: Read and Execute (This Folder Only)

My question is this: Should I check the 'Reset permissions on all child objects' checkbox?

This is probably a newbie question, but I dunno, the last time I messed with the root folder permissions everything went loopy.

Thanks in advance.

(W00t! More emoticons! ) Ahdkaw
Laptop Cauldrons run Thudex GUI

http://www.sensibilium.com/thud

 

[wbg34]

No, you should leave that unchecked.

 

[Sensibilium]

Thanks wbg34! Much appreciated

Could you/anyone explain the reason behind that? It seems that the 'Everyone' account has full access to every subfolder and file beneath the root folder. Will this be changed without the use of the 'reset permissions on all child objects' checkbox?

Permissions confuse me I'm afraid. Ahdkaw

http://www.sensibilium.com/

 

[wbg34]

If you check that box, then you are telling the computer that you want to change every file and folder on the C: drive to those permissions. In a default win2k install this can cause alot of problems for you. One example is that these permissions would allow any user that logs in to access everything under documents and settings including all of the administrators files. Leaving the box unchecked only changes the settings for the C:\ drive. I would recommend doing that and then getting a good book or guide (such as the NSA's guides for win2k) to hardening your server to help you determine what you want the remainder of your permissions should be.

 

[Sensibilium]

Thanks for the explanation, it is a little clearer in my head now. =)

I have the Windows 2000 Server Bible, so I'll have a look through that and see if there is any info inside, if not, I'll have a look for these NSA guides you mention.

Thanks again! Ahdkaw

http://www.sensibilium.com/