I want to share common data within a cluster of servers via network shares. There will be one share folder on each server, which all the other servers can access. The server processes that will be accessing this data are currently running as SYSTEM. I would like to restrict the permissions on these folders so that only the processes running on the other servers in the cluster can access the share. I do NOT want the network shares to be accessible to anyone else in the domain (except perhaps the admins who can remote into the servers anyway).
How do I configure the permissions on the file shares to accomplish this? Can it be done with the server processes running as SYSTEM? If there is no direct way to do this, is there a best practice work around?
Create a group and make the AD computer accounts for the cluster computers members of that group.
Set the NTFS permissions on the folder to "SYSTEM / Full Control", "MACHINE\Administrators / Full Control", and "The Cluster Member Group / Full Control". (I always include "MACHINE\Administrators" and "SYSTEM" with "Full Control" in virtually every permission I apply. Call it force-of-habit...)
Share the folder and set the Share Permission to "Everyone / Full Control". This effectively nullifies this "feature". The NTFS permissions will enforce the security you're looking for.
I believe you can do this by having the services run not as SYSTEM but as NetworkService(1). This allows the service to use the computer's Active Directory account on the network. Once you've done that, you can create an AD group containing the machine accounts of the servers that need access to the share. You can then set the Share permissions to only allow access from that created group. For extra protection, you can also set the NTFS permissions to allow modify from that one group, admins, and nothing else.
(1) Am remote, this may be doable with pure SYSTEM. Will double check when I have bandwidth