Initially, in our Windows domain environment, all Domain Users are by default Local Administrator of their own workstation. After some deliberation, it was decided that Domain Users should be removed from Local Administrator group for security reason. For that, they configured in the GPO to remove all users from Local Administrator group except for Administrator (built-in), DOMAIN\Administrator and Domain Administrators.

Once, they removed Domain Users from Local Administrator group, users began facing permission issues when launching certain application whereby the application does not have specific rights to read the config files in C:.

During the troubleshoot, one of the sysadmin gave Domain Users full rights to C: (%SystemDrive%). The rights was configured in Computer Configuration > Windows Settings > Security Settings > File Systems where Domain Users were given Full Control to %SystemDrive%. It was not sure if that policy helped in solving the problem and no one made a remark or description of it. It was left there as it is.

Today, after about 2 year, another sysadmin, noticed that particular policy setting while reviewing the group domain policy. The sysadmin decided that giving Domain User Full Control rights to %SystemDrive% is very risky in security perspective and removed Domain User permission entry from that policy. This is where the problem began.

After removing Domain User entry in the %SystemDrive% permission setting, one of our application encountered problem writing files to non-Windows system directories (e.g. C:\tmp or C:\msclog). At this point, it is pretty obvious that once Domain User was removed from that policy setting, the application does not have rights to write any files into non-Windows system directories. We worry that this may be further propogated into Windows system directories (e.g. C:\Windows, C:\Program Files, etc) and will lead to other problems in the future. At the same time, we cannot add / give Domain Users full permission to C: as well.

As such, is there anyway we can restore Windows file / folder permission to its original setting with GPO?

  • 3
    I think whoever is running things there needs to get a grip on whatever is going on and do a proper review of precisely how user workstations are configured and precisely what your requirements are going forwards for each individual app you use before anyone changes anything else. I've seen drunken lunges off high cliff-tops that caused less damage than whoever is in charge of this fiasco seems content to inflict on the business. – Rob Moir Sep 19 '14 at 17:51
  • The easiest solution would be to add the Domain Users group back to the local Administrators group until you get things sorted out. It may not be preferable but if users can't run critical Line Of Business applications because of this issue then this is the quickest way to get them working again. You can sort things out using a test system or two once you get everyone back to business. – joeqwerty Sep 19 '14 at 18:19
  • Doesn't anybody test the implementation of these type of global changes on a test subset before putting them into effect anymore? – mdpc Sep 19 '14 at 20:31

You need to do a few things here:

First, once you've applied security changed with GP, there's no going back. Removing the policy isn't going to remove the changes. There's a ton of different sets of permission through the entire system drive, so you can pretty much give up on ever getting them back to stock. Your best bet is to reimage your clients.

Second, you need to validate your applications running as standard users before you deploy changes like this. I worked through the same exact problem at my last job: all users had local administrative rights and I got them all down to just standard user rights. It's a pain in the a**, yes. You have to try each application and see which ones break, and yes, there will be plenty that are poorly written and require administrative access to function properly. For those, you can use a program like Process Monitor, a free utility from Microsoft, to see just which files they're trying to access and getting blocked on. Once you know this, you can use Group Policy to selectively grant access to those files. I would create domain groups for each application, grant file system permissions to those group, and then add your users to those groups to keep things easy to manage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.