131 reputation
3
bio website
location
age
visits member for 2 years, 8 months
seen Aug 4 at 21:30

Feb
28
answered dell poweredge r210 II mix memory
Sep
20
awarded  Teacher
Sep
16
comment NTFS: Deny all permissions for all files, except where explicitly added
Thanks for all the great answers and the effort. I upvoted all of them. Fair? What's the right thing to do here?
Sep
16
answered NTFS: Deny all permissions for all files, except where explicitly added
Sep
15
comment NTFS: Deny all permissions for all files, except where explicitly added
I'm doing it as a local admin. Are you sure I should tick the "[ ] Replace all child object permissions with inheritable permissions from this object"? Wouldn't this mess up all special permissions in C:\Windows for example?
Sep
15
comment Folder redirection save times are awful slow
Is regular access to a fileshare on that server slow as well?
Sep
15
comment NTFS: Deny all permissions for all files, except where explicitly added
I tried it, but it didn't work. The user still has access to almost all files. To make sure that I did the right thing: Right clicked C:, Security, Advanced, Change Permissions, Add..., enter username, check "Full control/Deny", uncheck "Traverse folder/Deny". I set the combobox at the top of the dialog to "This folder, subfolders and files" and (2nd attempt) to "This folder only". Both things didn't work. Probably related to the "Bypass traverse checking" right?
Sep
14
comment NTFS: Deny all permissions for all files, except where explicitly added
I'm not concerned about general server security. This user account is just used to sandbox one specific type of application, which is secured by other means too (restricted tokens, job objects and integrity levels). NTFS file permissions is just defense in depth. I'm mostly worried about the user reading confidential data - not deleting system files.
Sep
14
awarded  Student
Sep
14
comment NTFS: Deny all permissions for all files, except where explicitly added
Haven't thought about Bypass Traverse Checking. I just read KB823659 which states that "Therefore, removing the Everyone group from the list of security principals who have this user right by default could lead to operating system instability or to program failure. It is better that you leave this setting at its default.". How can I only deny a single account this right? Secpol.msc -> User Rights Assignment only allows me to add other users/groups, not to deny.
Sep
14
asked NTFS: Deny all permissions for all files, except where explicitly added
Jun
26
awarded  Supporter