I was looking at some of the new Windows servers I've inherited at my new job. Most of the shares have the default permissions for the drive inherited. Two entries are always there:
I've read the other Serverfault.com questions relating to this:
"CREATOR OWNER" NTFS group always has special permissions in windows
Windows Server : role of SYSTEM and CREATOR OWNER users?
as well as this link online:
However, in past IT lives I've always started with completely blank permissions for root folders of shares. So I might start with nothing but DOMAIN ADMINS - FULL CONTROL, and then add additional local or domain groups/users at that point.
I've never had an issue doing this with rights/backups/access/etc.
My question is:
What's the PROPER (best practice) here and why? Keep the default SYSTEM and CREATOR OWNER in the rights? Remove them and start from scratch?