-1

Ever since I begun working with Windows Server 2008 I have noticed that the SYSVOL folder C:\Windows\SYSVOL\sysvol is shared and the NTFS permissions for the Authenticated Users group are almost maxed.

enter image description here

Although I know that this folder has to be shared (and it is shared by default) I have to protect it somehow from the everyday users. Last week I turned off the shared permissions and it interrupted the execution of GPO.. ffs it took me whole day until i realized that after i removed the sharing the GPOs stoped processing on the client workstations :S.

So how to give the minimum permission settings on this folder so that it is protected from everyday users but the execution of the GPOs is not interrupted?

3
  • 1
    So what are you "protecting" the sysvol folder from? What precise threat vector are you worried about here? From what I see so far, the biggest threat is people changing settings without understanding the implications. Don't Play With The Sysvol Folder Unless You Want Bad Things To Happen.
    – Rob Moir
    Mar 20, 2012 at 15:30
  • I got it now... however I just don't want anyone except the Admins in our company to see the SYSVOL folder..
    – Spirit
    Mar 20, 2012 at 15:34
  • 1
    why? You shouldn't be storing anything confidential in there. If you have, for example, a login script that is delivered by GPO and includes a username and password then it may be possible to restrict viewing of that policy folder via special permissions, but I seriously wouldn't touch the sysvol folder itself.
    – Rob Moir
    Mar 20, 2012 at 15:53

2 Answers 2

3

It's obvious that you're out of your element here (no offense intended) so my suggestion is that you leave SYSVOL alone, unless you:

A. Modified NTFS permissions on the root folder prior to the creation of SYSVOL

B. Moved SYSVOL to another volume

c. Mucked with the NTFS permissions of SYSVOL

In which case, you should follow this article:

http://technet.microsoft.com/en-us/library/cc816750(v=ws.10).aspx

1

I don't see Everyone listed in your screenshot there... authenticated users is fine, they by default have to have the read and execute and list folder contents permissions to be able to apply GPO. As far as I know, there is no way to limit this, they have to be able to read it or they won't be able to apply GPO's.

3
  • Oh yes... it should be Authenticated Users... I will corect it now...
    – Spirit
    Mar 20, 2012 at 15:13
  • So i guess it is OK to be this way... Perhaps I can protect it further if I set the Hidden attribute to the SYSVOL folder?
    – Spirit
    Mar 20, 2012 at 15:17
  • yes setting it to hidden will prevent users from seeing it providing they don't have "show hidden files" enabled.
    – John
    Mar 20, 2012 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .