Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was looking at some of the new Windows servers I've inherited at my new job. Most of the shares have the default permissions for the drive inherited. Two entries are always there:

permissions

I've read the other Serverfault.com questions relating to this:

"CREATOR OWNER" NTFS group always has special permissions in windows

Windows Server : role of SYSTEM and CREATOR OWNER users?

as well as this link online:

Creator Owner Explained


However, in past IT lives I've always started with completely blank permissions for root folders of shares. So I might start with nothing but DOMAIN ADMINS - FULL CONTROL, and then add additional local or domain groups/users at that point.

I've never had an issue doing this with rights/backups/access/etc.

My question is:

What's the PROPER (best practice) here and why? Keep the default SYSTEM and CREATOR OWNER in the rights? Remove them and start from scratch?

share|improve this question
    
I would leave them because if a service is running with System user account and needs access to those files it will simplify things and because if someone is able to elevate their permissions to system on your box they are going to be able to own it anyhow (most likely) From a management standpoint it is easier to leave these permissions. From a security standpoint, they can be removed, but then you should remove them everywhere and make a point of creating service accounts to run any service (not use system account) and assign permissions as needed. –  user160910 Mar 22 '13 at 13:11

1 Answer 1

up vote 2 down vote accepted

Personally, I don't see SYSTEM as a security risk so I would be inclined to leave it as is on a relatively unknown system. I don't see the point in CREATOR OWNER being there.

If you do remove them, just follow good procedures - i.e., document everything and remove them from a few shares and see how things go for a couple of weeks, checking backups and access etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.