Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ever since I begun working with Windows Server 2008 I have noticed that the SYSVOL folder C:\Windows\SYSVOL\sysvol is shared and the NTFS permissions for the Authenticated Users group are almost maxed.

enter image description here

Although I know that this folder has to be shared (and it is shared by default) I have to protect it somehow from the everyday users. Last week I turned off the shared permissions and it interrupted the execution of GPO.. ffs it took me whole day until i realized that after i removed the sharing the GPOs stoped processing on the client workstations :S.

So how to give the minimum permission settings on this folder so that it is protected from everyday users but the execution of the GPOs is not interrupted?

share|improve this question
So what are you "protecting" the sysvol folder from? What precise threat vector are you worried about here? From what I see so far, the biggest threat is people changing settings without understanding the implications. Don't Play With The Sysvol Folder Unless You Want Bad Things To Happen. – RobM Mar 20 '12 at 15:30
I got it now... however I just don't want anyone except the Admins in our company to see the SYSVOL folder.. – Spirit Mar 20 '12 at 15:34
why? You shouldn't be storing anything confidential in there. If you have, for example, a login script that is delivered by GPO and includes a username and password then it may be possible to restrict viewing of that policy folder via special permissions, but I seriously wouldn't touch the sysvol folder itself. – RobM Mar 20 '12 at 15:53
up vote 3 down vote accepted

It's obvious that you're out of your element here (no offense intended) so my suggestion is that you leave SYSVOL alone, unless you:

A. Modified NTFS permissions on the root folder prior to the creation of SYSVOL

B. Moved SYSVOL to another volume

c. Mucked with the NTFS permissions of SYSVOL

In which case, you should follow this article:

share|improve this answer

I don't see Everyone listed in your screenshot there... authenticated users is fine, they by default have to have the read and execute and list folder contents permissions to be able to apply GPO. As far as I know, there is no way to limit this, they have to be able to read it or they won't be able to apply GPO's.

share|improve this answer
Oh yes... it should be Authenticated Users... I will corect it now... – Spirit Mar 20 '12 at 15:13
So i guess it is OK to be this way... Perhaps I can protect it further if I set the Hidden attribute to the SYSVOL folder? – Spirit Mar 20 '12 at 15:17
yes setting it to hidden will prevent users from seeing it providing they don't have "show hidden files" enabled. – John Mar 20 '12 at 18:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.