Windows 2000/NT Server NTFS Permission Question

The Fact :

I have a Windows 2000 and 2 NT Server.
My first NT Server is PDB on C/D Drive and a file server on E Drive.
My second NT Server is BDC, Print Server on C Drive and File Server on D Drive.
My Windows 2000 is Mailserver with Exchange 5.5, IIS running (With Lockdown Tool).
Except administrator, nobody is logging locally or remotly (For Windows 2000) on the machine.

Question :

Can I safely reset all the file permission to Admin and System to Full Control for ALL File? That mean taking the C Drive File Permission, changing them so only Admin and System have Full Control and applying them to all child objets.

I know that I need to do some exception.

1) Print directory on second NT Server
2) Exchange Directory on the Mailserver.
3) IIS Right on a few file (Inetput and Windows/system32)

Possible or not?

Let me see if I understand you correct, you want to set Administrator and System to have Full Control. This can be done, but if there is other users, make sure they atleast have Read/Execute permissions on the Winnt folder.

Their is no other user connecting to this server except for PBD or BDC and File Sharing (But I doesn't touch those permission)

Quote:

---

Can I safely reset all the file permission to Admin and System to Full Control for ALL File? That mean taking the C Drive File Permission, changing them so only Admin and System have Full Control and applying them to all child objets.

---

That should all ready be like this? Admin can have full control whenever they want. they just have to take it. Is there any specific reason you want to do this? Is there something you don't have access to now, that you need? or, you just want to do it for shits and giggles?

I want to do for security. I want to remove all users right locally. I have an audit of security telling me some file need better NTFS protection and that I need to change them. But why should I bother removing users group from a few file when I can remove their access to all file since they aren't logging on the server.

Oh, I see what you are saying. Sorry. I'm sick and on 4 different cold/alergy medicines.
Didn't quite understand at first. :)

You can remove everyone else, that should be fine. (do it on a test box first)
I wouldn't mess too much with the system or admin permissions though.

Tweak them those you need to.

Make sure that you leave the permissions for the annonymous internet user account and such if you are using them, etc. If you are running services as other users, then those users will need access to the files used by those services.

Most service using special account are under the local administrator group so.. :)

So it possible, you allready done that?

Yes, I do that for all my boxes. Then strict permissions on groups/users per shares (if there are any).

Generally, I remove all local accounts and make everyone use domain accounts.
I only keep the admin acct (renamed) and remove everyone else from the FS permissions too.

Do it on a test box first though. You don't want to screw up a real server.

ok! Thank for info!
Any nobody else try that?

If you are going to have domain accts log into that box, be sure to set appropriate permissions for that too.

But, since you said that only admin and system are going to be using it. You *should* be fine.

I'm more worried about the fact is those Nt server are PDC and BDC. I don't know the file touch by those service.

I know the file touch by changing file permission for a print server, exchange and IIS.

There are several problems tha you will run into. I can't think of all of them off the top of my head but here are a few:

The print spooler (as you mentioned) needs to have athenticated users group with change perms I think.

The netlogon share needs to have authenticated users group with read perms.

IIS requires many changes depending on what kind of content you are serving and whether you allow annon. access. Look for the knowledge base article 271071 - HOW TO Set Basic NTFS Permissions for IIS 5_0.htm or look for the one on the version of IIS that you are running.

If this is a production environment... be very careful. If you have the hardware, build yourself a test environment that mirrors you production one and test these changes out ahead of time. Otherwise be prepared to pick up the pieces afterword.

Do some searches on Google on the minimum settings required to run your apps. You should be able to find what you need. Just don't believe the first doc you find though. Find several and compare them. There are several documents out there on how to secure IIS and most of them leave out some critical items.