I'm trying to lock down my IIS and SQL servers. I have a checklist of items to check, but the checklist does not take into account the TrustedInstaller account, which seems to have file permissions to everything.
One problem I'm having is that I need to make a few registry/dll changes. Many of the registry entries I need to modify, as well as the entire System32 folder, are owned by the TrustedInstaller. To make the changes I need to make, I'm having to take ownership of the files/registry entries, and then grant myself additional access.
Another problem I'm having is in locking down certain folders, such as the IIS dlls in system32. I want to minimize the number of accounts that have access to this folder, and I'm noticing again that TrustedInstaller is owner and has full control over these files.
So, what exactly is TrustedInstaller used for, and does it need to be the owner of these files? If not the owner, does it require full controll over these files?
I am using Windows Server 2008 R2.