1
vote
2answers
26 views

Choosing which user to run service as and where to install programs

From the Principle of Least Privilege, I understand that I should install a network service as its own user. Where should the software be installed to? For example, say I create a user Tomcat (for ...
4
votes
2answers
113 views

Network Service account or domain account? [closed]

What are the pros and cons, or best practices when it comes to setting up applications on a server with either the Network Service account or a domain account? Are there some cases in which you'd do ...
0
votes
1answer
42 views

What are the minimal permissions for WMI access to processes CommandLine?

I have been trying to get a remote listing of running windows processes including their CommandLine/ExecutablePath attribute through WMI as a non-administrator domain user for a monitoring tool. I ...
6
votes
1answer
168 views

Evaluating current ACEs on NTFS ACLs with PowerShell

We have a document management system that has million of files on a NTFS file system accessed through a network share. A single service account needs full permission to all of these files and the ...
2
votes
1answer
53 views

Allowing unpermitted group to access share - Windows 7

I've been a Linux sysadmin and am new to Windows so I apologize for the n00b question. I have two groups lets call them "Students" and "Professors". Students are very restricted, however professors ...
1
vote
2answers
113 views

How can I vew the drivers installed to a printer as a limited user?

...alternately, what permissions do I need to give someone so they can view (but not alter) the Additional Drivers on a network printer shared out from a Windows print Server? (Server 2008 R2, Server ...
4
votes
1answer
123 views

Single Sign On and NFS permissions on Windows

Like many, I've been trying to move away from Microsoft Active Directory + CIFS file sharing into a custom LDAP solution + NFSv4. All the workstations here run Windows 7, and I have set up the ...
6
votes
1answer
388 views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain ...
2
votes
2answers
61 views

Sharing and NTFS-security

We have recently gotten a new system delivered to us. It's a standard Server 2008 and Windows 7 server-client solution with some tightened security. One of the new security policies have caused a ...
4
votes
1answer
113 views

What exactly is included in the Windows “Everything” security identifier (e.g. does it include computer accounts like DOMAIN\MACHINE$)?

This is a generalization of a question I initially had asked about computer accounts. I asked: When one sets Windows permissions for "Everyone", do these permissions apply to computer accounts ...
0
votes
0answers
30 views

Permissions not being inherited

So I have a parent folder FolderA which has: Administrator FullControl Allow FileAccessGroup FullControl Allow TerminalServerDeny FullControl Deny FolderB is a sub-folder with Inheritance enabled ...
0
votes
1answer
85 views

How to recognize windows' permissions on a OSX server share

I have a server running OSX (Mountain Lion), accessed by a Windows 7 box. Investigating a permissions problem from the Win client, I open the permissions dialog on a network share's directory and see ...
0
votes
1answer
23 views

IUSR_machinename Group Membership?

I've been searching for a while and am having trouble finding the answer. I have an IIS6 server running WebDAV for HTTP PUT uploads through anonymous access. The uploads work fine and the newly ...
2
votes
1answer
2k views

Unable to modify registry as admin on Windows 2012

On Windows 2012, I'm trying to change the AppIDFlags value in the registry key HKEY_CLASSES_ROOT\AppID\{E62A7A31-6025-408E-87F6-81AEB0DC9347} to allow interaction with the desktop as documented here: ...
1
vote
1answer
128 views

Restoring NTFS permissions

I have two large file shares where the following has occurred: A (currently unknown) administrator took ownership of the share. The administrator broke inheritance on the share, and removed the ...
0
votes
1answer
406 views

windows server C drive and shared folder permission

i have an app, that needs to run in the folder in root of C drive (C:\AppFolder). And on client, i need map network drive for C:\ because that app searches for \AppFolder... directory. So i have ...
0
votes
1answer
132 views

Setting folder permission on a remote Windows 2008 R2 server in PowerShell or Command Prompt

Does anyone know of a way to set a folder's permissions on a remote server using either PowerShell or the command prompt? In other words, sitting at server01, launch PS or CP, type a command to set ...
2
votes
1answer
1k views

What is the best way to fix NTFS file permissions to inherit parent?

When XP clients move files on the same volume, the permissions are moved with it. With Windows 7 clients and up, when a file is moved, the permissions are inherited. Unfortunately, we still have a ...
0
votes
0answers
39 views

Prevent user deleting directory junction

I have a setup where there's a directory junction in a network share which points at a directory outside of the share. No matter what permissions I set, the user is able to delete the junction ...
0
votes
3answers
3k views

Remote desktop settings grayed out for windows server 2008

I am remotely connected to a box(as an administrator) running windows server 2008. However when I go to system properties >> remote, the options for remote desktop are grayed out. Does anyone know why ...
4
votes
1answer
96 views

Tool to see nested permissions?

Here's the situation. Often I need to tell how a user is getting access to a specific folder. I can see in "Effective permissions" that they have read/write/etc, but because of nested groups I can't ...
1
vote
1answer
255 views

Robocopy and NTFS Permissions

If as an administrator I remove all permissions from a folder - and set the owner to another user in Active Directory, I will not be able to copy that folder through explorer to another folder/drive ...
2
votes
1answer
145 views

Windows: setting folder permissions for exactly one level of folders

Here I have a folder (E:\projects, which is also shared via the network) with several hundred folders like E:\projects\project1, E:\projects\project2, E:\projects\project3.... Each of these folders ...
0
votes
1answer
70 views

Unsafe to run Apache as LOCALSYSTEM on Windows Server?

On my server (Windows Server 2008 R2), I have installed a couple of programs coming with a web interface. As I want to be able to access those web interfaces from outside my LAN, the relevant ports ...
0
votes
1answer
152 views

Windows 2008 R2 file share - any way to “lock it down” outside of a 3rd party app?

I have a 3rd party app that "makes a call" to write files to a file share on our network using the currently logged in credentials of the Windows domain user. Meaning the 3rd party app doesn't pass ...
13
votes
3answers
835 views

Windows File Permissions and Attributes

I'm somewhat confused about the whole Windows file security scheme. I come from a unix background, so I don't fully understand the relationship between file permissions/security settings and the ...
0
votes
1answer
1k views

How to escalate to administrative token in Windows 7 using only CMD.exe [duplicate]

If I am not able to right click on CMD and run as administrator, or CTRL + Shift + Enter to run CMD, but I am using an administrative user account in a non-admin shell (CMD.exe); How in the world do I ...
1
vote
1answer
1k views

Can't access Samba share from Windows

I am new to SLES and Samba so I need some help. I set up Samba on SUSE 11 successfully. I was able to create a share with no user restrictions which I managed to access from Windows. But I want to ...
4
votes
2answers
716 views

Is it possible to list all permissions where I don't have access

I'm looking for a way to recursively go through my entire file share ( fairly large 3TB of files ) and list out all files/folders that I don't have access to. Due to a migration and some errors on ...
3
votes
2answers
85 views

What permissions could a printer driver require?

Windows 7 Professional, 32bit We have a specialized printer for specific production tasks. This printer's driver has a strange problem where some of the options in the Printer Preferences are ...
0
votes
1answer
33 views

After Deny Total Control the file has gone

To make a test, I've marked "Deny Total Control" to a file to all groups, and the file disappeared. Now, how I undo this condition? I've already tried to enforce the directory permission to all ...
4
votes
1answer
3k views

What does it mean to grant/set permissions for NETWORK SERVICE on a network share?

I'm confused about the NETWORK SERVICE account (group?) works on network shares: On one hand, NETWORK SERVICE is generally described as an account that's local to a given machine. (See, e.g., here on ...
2
votes
2answers
334 views

Best Practices - Exporting/Importing Windows 2008 file/folder permissions

I'm in the process of creating a secondary website on our webserver which I would like to have identical folder and (mostly) file permissions but completely different content. Ideally I would like to ...
0
votes
0answers
39 views

Starting a server as a local service, not my user account

I have a third party tool (CordaServer.exe) that I start right now manually on my Windows Server 2008 machine. When I remote into that machine and start it, it starts under my account and not the ...
-1
votes
1answer
196 views

User in Administrators group can't access files via smbclient [closed]

I created a user ("backupagent") on a laptop running Windows 7 Home Premium, and added that user to the Administrators group, with a randomly-generated, difficult-to-guess password. My plan is to log ...
0
votes
1answer
50 views

Is NETWORK SERVICE part of the INTERACTIVE group in windows?

Is the NETWORK SERVICE user considered part of the INTERACTIVE windows group? I have IIS6 Application Pools running using NETWORK SERVICE identity so I want to know if they'll get permissions granted ...
2
votes
1answer
242 views

Restricting access to Share using both an AD user using a specific Computer

The Environment: One AD domain that is not managed by local admins (can’t edit, can’t add GPO, etc.) Users have accounts here. Call this AD alpha This AD Alpha has a trust to a local AD domain (Call ...
2
votes
1answer
1k views

Force NTFS permissions inheritance for newly created files

Does anybody know a way to force that all files that get created inside some folder inherit the NTFS permissions of that folder. The problem is the following: I have a third party software that is ...
0
votes
1answer
1k views

Running a batch file from PHP - interactive services detection? [closed]

I am having a very hard time getting an executable to run from within a PHP script (using exec(), or a number of other PHP commands I've tried). The issue seems to be coming down to a question of ...
5
votes
4answers
3k views

NTFS Permissions for root share that houses Home Directories Windows Server 2008 R2

I am using the AD Profile Tab to Auto create Home Directories at \server\home so the permissions are automatically created. What should the permissions (NTFS) be for the actual folder that the home ...
1
vote
0answers
487 views

Disabling all write (cd burning) permissions for a specific group of users on all CD/DVD drives mounted in Windows XP Pro SP3

I want all users within 'Restricted' user group (Windows XP Professional SP3) to be able to read from CDs/DVDs they insert. I don't want these users to be able to burn any CDs/DVDs using CDRW/DVDRW ...
1
vote
1answer
422 views

BITS http download job fails to connect for owner Local SYSTEM account

A service I have written that uses BITS (Background Intelligent Transfer Service) to auto update itself is having a problem on some machines (Windows 7 so far). I have been investigating and have ...
4
votes
1answer
2k views

Granting service control manager access permission to user outside of administrator group

I have a user outside of administrator group. How can I grant service control manager access permission for that (specific) user? It's like SC_MANAGER_ALL_ACCESS from the following link: ...
0
votes
1answer
37 views

file permissions for the same user on 2 different computers

I'm trying to change file permissions on a windows server for a domain. It works fine except for one little problem. There is a co-worker that logs in using the same user as mine but on my computer I ...
2
votes
1answer
2k views

Samba share accessible via IP address, but not via hostname

I have a CentOS VM running in VMWare player. The host is Windows Server 2008 R2. The hostname is set properly. The FQDN is hostname.company.net. The wiki is accessible via browser both via the short ...
0
votes
1answer
190 views

Windows 2008 file share permissions

How can you stop users from moving folders and files in a Windows 2008 share, but still allow them to create new folders, rename folders, open files and save files?
1
vote
1answer
175 views

Sharing folder with 10m+ files on win xp takes hours to set access rights [closed]

I try to share whole partition in windows xp. On this partition are 10+ milion files. Windows sets access rights to each of them and it has been doining that for last 12 hours and hasn't yet finished. ...
2
votes
2answers
503 views

changing permissions for a network share takes longer on win2008 than on win2003, why is that?

Given a network share accessible for "everyone" in the domain, containing several 1000 files and folders When I change permissions for this share from read/write to only read (or vice versa) on ...
1
vote
3answers
411 views

A user in multiple user groups not receiving correct permissons

A little intro: I'm not a server admin, but I do some tech support for a small software company whose product requires users to have full control permissions to a mapped drive on the server in order ...
4
votes
3answers
14k views

User in domain admin group cannot access directory the group has permission to access

I've run into a rather interesting issue when playing with one of my domain labs. There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. ...