Initially, in our Windows domain environment, all Domain Users are by default Local Administrator of their own workstation. After some deliberation, it was decided that Domain Users should be removed from Local Administrator group for security reason. For that, they configured in the GPO to remove all users from Local Administrator group except for Administrator (built-in), DOMAIN\Administrator and Domain Administrators.
Once, they removed Domain Users from Local Administrator group, users began facing permission issues when launching certain application whereby the application does not have specific rights to read the config files in C:.
During the troubleshoot, one of the sysadmin gave Domain Users full rights to C: (%SystemDrive%). The rights was configured in
Computer Configuration > Windows Settings > Security Settings > File Systems where Domain Users were given Full Control to %SystemDrive%. It was not sure if that policy helped in solving the problem and no one made a remark or description of it. It was left there as it is.
Today, after about 2 year, another sysadmin, noticed that particular policy setting while reviewing the group domain policy. The sysadmin decided that giving Domain User Full Control rights to %SystemDrive% is very risky in security perspective and removed Domain User permission entry from that policy. This is where the problem began.
After removing Domain User entry in the %SystemDrive% permission setting, one of our application encountered problem writing files to non-Windows system directories (e.g. C:\tmp or C:\msclog). At this point, it is pretty obvious that once Domain User was removed from that policy setting, the application does not have rights to write any files into non-Windows system directories. We worry that this may be further propogated into Windows system directories (e.g. C:\Windows, C:\Program Files, etc) and will lead to other problems in the future. At the same time, we cannot add / give Domain Users full permission to C: as well.
As such, is there anyway we can restore Windows file / folder permission to its original setting with GPO?