383 lines
28 KiB
Plaintext
383 lines
28 KiB
Plaintext
|
; (c) Microsoft Corporation 1997-2000
|
||
|
|
;
|
||
|
|
; Security Configuration Template for Security Configuration Editor
|
||
|
|
;
|
||
|
|
; Template Name: DCUp.INF
|
||
|
|
; Template Version: 05.10.DU.0000
|
||
|
|
;
|
||
|
|
; Default Security For DC Promo when applied to a 4.0 DC Upgrade.
|
||
|
|
|
||
|
|
[version]
|
||
|
|
signature="$CHICAGO$"
|
||
|
|
revision=1
|
||
|
|
|
||
|
|
;----------------------------------------------------------------
|
||
|
|
;Event Log - Log Settings
|
||
|
|
;----------------------------------------------------------------
|
||
|
|
|
||
|
|
[System Log]
|
||
|
|
RestrictGuestAccess = 1
|
||
|
|
|
||
|
|
[Security Log]
|
||
|
|
RestrictGuestAccess = 1
|
||
|
|
|
||
|
|
[Application Log]
|
||
|
|
RestrictGuestAccess = 1
|
||
|
|
|
||
|
|
;----------------------------------------------------------------------
|
||
|
|
; Privileges & Rights
|
||
|
|
;----------------------------------------------------------------------
|
||
|
|
;
|
||
|
|
;World S-1-1-0
|
||
|
|
;
|
||
|
|
;NT Authority S-1-5
|
||
|
|
;ENTERPRISE_CONTROLLERS 9
|
||
|
|
;AUTHENTICATED_USER 11
|
||
|
|
;LOCAL_SERVICE 19
|
||
|
|
;NETWORK_SERVICE 20
|
||
|
|
;
|
||
|
|
;Built-In Domain SubAuthority = S-1-5-32
|
||
|
|
;ADMINISTRATORS 544
|
||
|
|
;USERS 545
|
||
|
|
;GUESTS 546
|
||
|
|
;POWER_USERS 547
|
||
|
|
;ACCOUNT_OPS 548
|
||
|
|
;SYSTEM_OPS 549
|
||
|
|
;PRINT_OPS 550
|
||
|
|
;BACKUP_OPS 551
|
||
|
|
;REPLICATOR 552
|
||
|
|
;RAS_SERVERS 553
|
||
|
|
;PREW2KCOMPACCESS 554
|
||
|
|
;REMOTE_DESKTOP_USERS 555
|
||
|
|
;NETWORK_CONFIGURATION_OPS 556
|
||
|
|
|
||
|
|
[Privilege Rights]
|
||
|
|
;Remove Power User from everything to force engine to recalculate existing rights
|
||
|
|
;and add to default dC GPO. Adds only for rights that did not exist on NT4 or
|
||
|
|
;which have modified defaults for NT5.
|
||
|
|
SeAssignPrimaryTokenPrivilege = Add:, *S-1-5-19, *S-1-5-20, Remove:, *S-1-5-32-547
|
||
|
|
SeAuditPrivilege = Add:, *S-1-5-19, *S-1-5-20, Remove:, *S-1-5-32-547
|
||
|
|
SeBackupPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeBatchLogonRight = Remove:, *S-1-5-32-547
|
||
|
|
SeChangeNotifyPrivilege = Add:, *S-1-5-32-554, Remove:, *S-1-5-32-551, *S-1-5-32-547, *S-1-5-32-545
|
||
|
|
SeCreatePagefilePrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeCreatePermanentPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeCreateTokenPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeDebugPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeIncreaseBasePriorityPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeIncreaseQuotaPrivilege = Add:, *S-1-5-19, *S-1-5-20, Remove:, *S-1-5-32-547
|
||
|
|
SeInteractiveLogonRight = Remove:, *S-1-5-32-547, *S-1-5-11, *S-1-5-32-546, %SceInfGuest%, *S-1-5-32-545, *S-1-1-0
|
||
|
|
SeLoadDriverPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeLockMemoryPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeManageVolumePrivilege = Add:, *S-1-5-32-544, Remove:, *S-1-5-32-547
|
||
|
|
SeNetworkLogonRight = Add:, *S-1-5-11, *S-1-5-9, *S-1-5-32-554, Remove:, *S-1-5-32-551, *S-1-5-32-547, *S-1-5-32-546, %SceInfGuest%, *S-1-5-32-545
|
||
|
|
SeProfileSingleProcessPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeRemoteInteractiveLogonRight = Add:, *S-1-5-32-544
|
||
|
|
SeRemoteShutdownPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeRestorePrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeSecurityPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeServiceLogonRight = Remove:, *S-1-5-32-547
|
||
|
|
SeShutdownPrivilege = Remove:, *S-1-5-32-547, *S-1-5-11, *S-1-5-32-546, %SceInfGuest%, *S-1-5-32-545, *S-1-1-0
|
||
|
|
SeSystemEnvironmentPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeSystemProfilePrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeSystemTimePrivilege = Remove:, *S-1-5-32-547, *S-1-5-19, *S-1-5-20
|
||
|
|
SeTakeOwnershipPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeTcbPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
;
|
||
|
|
SeDenyInteractiveLogonRight = Remove:, *S-1-5-32-547
|
||
|
|
SeDenyBatchLogonRight = Remove:, *S-1-5-32-547
|
||
|
|
SeDenyServiceLogonRight = Remove:, *S-1-5-32-547
|
||
|
|
SeDenyNetworkLogonRight = Remove:, *S-1-5-32-547
|
||
|
|
SeDenyRemoteInteractiveLogonRight = Remove:, *S-1-5-32-547
|
||
|
|
;
|
||
|
|
SeEnableDelegationPrivilege = Add:, *S-1-5-32-544, Remove:, *S-1-5-32-547
|
||
|
|
SeMachineAccountPrivilege = Add:, *S-1-5-11, Remove:, *S-1-5-32-547
|
||
|
|
SeSyncAgentPrivilege = Remove:, *S-1-5-32-547
|
||
|
|
SeUndockPrivilege = Add:, *S-1-5-32-544, Remove:, *S-1-5-32-547, *S-1-5-32-545
|
||
|
|
|
||
|
|
[Service General Setting]
|
||
|
|
;Note: SCECLI is hooked so that startup mode is not configured during setup\dcpromo.
|
||
|
|
;autostarted on workstations and servers, standalone or joined
|
||
|
|
Browser,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
Dhcp,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRRC;;;NO)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
TrkWks,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
Dnscache,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRRC;;;NO)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
Eventlog,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
PolicyAgent,2,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
dmserver,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
Messenger,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
PlugPlay,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
Spooler,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
ProtectedStorage,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
RpcSs,2,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
NtmsSvc,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
seclogon,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
SamSs,2,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
lanmanserver,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
SENS,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
Schedule,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
LmHosts,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
LanmanWorkstation,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
RemoteRegistry,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
|
||
|
|
;Not autostarted, but non-default DACL - Remove PU ability to change template
|
||
|
|
ClipSrv,3,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
NetDDE,3,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
NetDDEdsdm,3,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
AppMgmt,3,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
EventSystem,3,"D:(A;;CCLCSWRPLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
|
||
|
|
;Not autostarted if machine is standalone
|
||
|
|
Netlogon,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
W32Time,2,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
|
||
|
|
;Not autostarted if Wksta
|
||
|
|
Alerter,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
MSDTC,2,"D:(A;;CCLCSWRPLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLORC;;;NS)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
|
||
|
|
;Server Only Services
|
||
|
|
Dfs,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
LicenseService,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
SMTPSVC,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
|
||
|
|
;IIS Specific Services - Leave them alone
|
||
|
|
;IISADMIN,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
;W3SVC,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
;MSFTPSVC,2,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
||
|
|
|
||
|
|
|
||
|
|
;----------------------------------------------------------------
|
||
|
|
;Registry Values
|
||
|
|
;----------------------------------------------------------------
|
||
|
|
[Registry Values]
|
||
|
|
|
||
|
|
;Whatever Registry values are defined here end up in the Default DC GPO if that GPO does not exist (NT4DC to First Whistler).
|
||
|
|
;This is consistent with defltdc (NT5 Server to First Whistler DC), but different from DCUP5.
|
||
|
|
;DCUP5 is a straight upgrade (no DCPROMO) and so with DCUP5, the default DC GPO is never modified.
|
||
|
|
;In short, adding a new value (beyond SMB signing) here for synchronization purposes will
|
||
|
|
;make NT4DC to First Whistler DC inconsistent with NT5DC to Whistler DC.
|
||
|
|
;Note: New reg values for Whistler would have been configured locally when the NT4 DC was turned into a Whistler Server.
|
||
|
|
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1
|
||
|
|
|
||
|
|
;All DC's should be consistent wrt secure channel signing
|
||
|
|
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4,1
|
||
|
|
|
||
|
|
|
||
|
|
[Registry Keys]
|
||
|
|
|
||
|
|
"MACHINE\SOFTWARE",2,"D:P(A;CI;GR;;;AU)(A;CI;GRGWSD;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
;Same as parent, but this is the target of a symlink - set explicitly rather than inherit.
|
||
|
|
"MACHINE\SOFTWARE\Classes",2,"D:P(A;CI;GR;;;AU)(A;CI;GRGWSD;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\ADs\Providers\LDAP\Extensions",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
@@:@i:"MACHINE\SOFTWARE\Microsoft\ADs\Providers\NDS",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
@@:@i:"MACHINE\SOFTWARE\Microsoft\ADs\Providers\NWCOMPAT",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\ADs\Providers\WinNT",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Command Processor",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Cryptography",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Cryptography\Calais",2,"D:AR(A;CI;GRGWSD;;;LS)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Driver Signing",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Non-Driver Signing",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\NetDDE",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\NTDS",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Ole",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider",1,"D:AR"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Rpc",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\SystemCertificates",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
;Don't overwrite the following keys which are protected and secured by the component
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy",1,"D:AR"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer",1,"D:AR"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",1,"D:AR"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\MSDTC",1,"D:AR"
|
||
|
|
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony",2,"D:P(A;CIOI;GR;;;BU)(A;CIOI;GRGWSD;;;PU)(A;CIOI;GA;;;NS)(A;CIOI;GA;;;LS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Asr\Commands",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GRGWSD;;;BO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Classes",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontMapper",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib",2,"D:P(A;CI;GR;;;IU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GR;;;NS)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009",1,"D:AR"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SecEdit",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SOFTWARE\Policies",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SYSTEM",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SYSTEM\Clone",1,"D:AR"
|
||
|
|
|
||
|
|
"MACHINE\SYSTEM\ControlSet001",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet002",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet003",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet004",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet005",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet006",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet007",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet008",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet009",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\ControlSet010",1,"D:AR"
|
||
|
|
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control",2,"D:P(A;CI;GR;;;AU)(A;CI;GRGWSD;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\Class",1,"D:AR"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout",2,"D:(A;CI;GR;;;WD)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts",2,"D:(A;CI;GR;;;WD)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\LSA",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\Network",2,"D:(A;CI;GRGWSD;;;NO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\PriorityControl",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg",2,"D:P(A;CI;GA;;;BA)(A;;GR;;;BO)(A;CI;GR;;;LS)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security",2,"D:P(A;CI;GR;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Enum",1,"D:AR"
|
||
|
|
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles",1,"D:AR"
|
||
|
|
|
||
|
|
;Don't whack more restrictive security subkeys
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services",0,"D:P(A;CI;GR;;;AU)(A;CI;GRGWSD;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\EventLog",0,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\KDC",0,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\NTDS",0,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\NTFRS",0,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust",0,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries",2,"D:(A;CI;GA;;;NS)"
|
||
|
|
|
||
|
|
"USERS\.DEFAULT",2,"D:P(A;CI;GR;;;AU)(A;CI;GR;;;SO)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
||
|
|
"USERS\.DEFAULT\Software\Microsoft\NetDDE",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)"
|
||
|
|
"USERS\.DEFAULT\SOFTWARE\Microsoft\Protected Storage System Provider",1,"D:AR"
|
||
|
|
"USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\ProtectedRoots",1,"D:AR"
|
||
|
|
|
||
|
|
|
||
|
|
[File Security]
|
||
|
|
|
||
|
|
;---------------------------------------------------------------------------------------
|
||
|
|
;x86 Boot Files
|
||
|
|
;---------------------------------------------------------------------------------------
|
||
|
|
@@:@i:"%BootDrive%\boot.ini",2,"D:P(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
@@:@i:"%BootDrive%\ntdetect.com",2,"D:P(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
@@:@i:"%BootDrive%\ntldr",2,"D:P(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
@@:@i:"%BootDrive%\ntbootdd.sys",2,"D:P(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
@@:@i:"%BootDrive%\autoexec.bat",2,"D:P(A;;GRGX;;;AU)(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
@@:@i:"%BootDrive%\config.sys",2,"D:P(A;;GRGX;;;AU)(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
|
||
|
|
;---------------------------------------------------------------------------------------
|
||
|
|
;amd64 Boot Files
|
||
|
|
;---------------------------------------------------------------------------------------
|
||
|
|
@@:@a:"%BootDrive%\boot.ini",2,"D:P(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
@@:@a:"%BootDrive%\ntdetect.com",2,"D:P(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
@@:@a:"%BootDrive%\ntldr",2,"D:P(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
|
||
|
|
;SetupSecurity will contain the new root acl. Ignore docs and settings if it's reapplied (e.g. on conversion from FAT)
|
||
|
|
;Probably not necessary on upgrade, but just in case.
|
||
|
|
"%SystemDrive%\Documents and Settings",1,"D:AR"
|
||
|
|
|
||
|
|
;NT4 Temp Directory
|
||
|
|
"%SystemDrive%\Temp",2,"D:P(A;CI;0x100026;;;AU)(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
;ProgramFiles
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
"%SceInfProgramFiles%",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
;System Root (Typically \WINDOWS)
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
"%SystemRoot%",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
|
||
|
|
;Different from parent
|
||
|
|
"%SystemRoot%\Debug\UserMode",2,"D:PAR(A;;0x00100023;;;AU)(A;OIIO;0x00100006;;;AU)(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
||
|
|
"%SystemRoot%\AppPatch",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemRoot%\Driver Cache",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemRoot%\mui",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemRoot%\Resources",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemRoot%\repair",2,"D:P(A;CI;GRGX;;;AU)(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemRoot%\security",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
||
|
|
"%SystemRoot%\Temp",2,"D:P(A;CI;0x100026;;;AU)(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemRoot%\WinSxS",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
|
||
|
|
;Directories that did not exist when security applied during clean-install Server - Creator specifies directory security.
|
||
|
|
;We explicitly ignore so as not to whack the component-specified DIRECTORY security during DCPromo.
|
||
|
|
;Previous directory security should be compatible with DC's or component should reset during DCPromo.
|
||
|
|
"%SystemRoot%\CSC",1,"D:AR"
|
||
|
|
"%SystemRoot%\Installer",1,"D:AR"
|
||
|
|
"%SystemRoot%\Prefetch",1,"D:AR"
|
||
|
|
"%SystemRoot%\Profiles",1,"D:AR"
|
||
|
|
"%SystemRoot%\repair",2,"D:P(A;CI;GRGX;;;AU)(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemRoot%\security",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
||
|
|
"%SystemRoot%\TAPI",2,"D:P(A;CIOI;GR;;;BU)(A;CIOI;GRGWSD;;;PU)(A;CIOI;GA;;;NS)(A;CIOI;GA;;;LS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%Systemroot%\tasks",1,"D:AR"
|
||
|
|
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
;System Directory (Typically \Windows\System32)
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
"%SystemDirectory%",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
|
||
|
|
;Differences from parent
|
||
|
|
"%SystemDirectory%\catroot",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemDirectory%\catroot2",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemDirectory%\config",2,"D:P(A;CI;GRGX;;;AU)(A;CI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
;Profile for system account - moved from Docs and Settings in Whistler. Creator specifies security.
|
||
|
|
"%SystemDirectory%\config\systemprofile",1,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
||
|
|
"%SystemDirectory%\dhcp",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemDirectory%\dllcache",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
||
|
|
"%SystemDirectory%\Export",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemDirectory%\GroupPolicy",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemDirectory%\ias",2,"D:P(A;CIOI;GRGWGXSD;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemDirectory%\mui",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%SystemDirectory%\spool",2,"D:(A;CIOI;GA;;;PO)"
|
||
|
|
"%SystemDirectory%\spool\printers",2,"D:P(A;CI;DCLCSWWPLO;;;BU)(A;CI;DCLCSWWPLO;;;SO)(A;CIOI;GA;;;PO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
|
||
|
|
"%SystemDirectory%\Autoexec.nt",2,"D:P(A;;GRGX;;;AU)(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
"%SystemDirectory%\CMOS.RAM",2,"D:P(A;;GRGX;;;AU)(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
"%SystemDirectory%\Config.nt",2,"D:P(A;;GRGX;;;AU)(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
"%SystemDirectory%\Midimap.cfg",2,"D:P(A;;GRGX;;;AU)(A;;GRGWGXSD;;;SO)(A;;GA;;;BA)(A;;GA;;;SY)"
|
||
|
|
|
||
|
|
;Directories that did not exist when security applied during clean-install Server - Creator specifies directory security.
|
||
|
|
;We explicitly ignore so as not to whack the component-specified DIRECTORY security during DCPromo.
|
||
|
|
;Previous directory security should be compatible with DC's or component should reset during DCPromo.
|
||
|
|
"%SystemDirectory%\appmgmt",1,"D:AR"
|
||
|
|
"%SystemDirectory%\DTCLog",1,"D:AR"
|
||
|
|
"%SystemDirectory%\msdtc",1,"D:AR"
|
||
|
|
;BugBug - Licensing service should use the Network Service profile directory - Remove the following line after B2.
|
||
|
|
"%SystemDirectory%\LLS",1,"D:AR"
|
||
|
|
"%SystemDirectory%\CPL.CFG",1,"D:AR"
|
||
|
|
"%SystemDirectory%\NTMSData",1,"D:AR"
|
||
|
|
"%SystemDirectory%\ReinstallBackups",1,"D:AR"
|
||
|
|
"%SystemDirectory%\repl",1,"D:AR"
|
||
|
|
"%SystemDirectory%\Setup",1,"D:AR"
|
||
|
|
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
;DS Data and Log Directories. Engine resolves via registry.
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
;Relying on fact that engine lets last one win when DSLog and DSDit are the same.
|
||
|
|
"%DSDIT%",2,"D:P(A;CIOI;GA;;;SY)(A;CIOI;GA;;;BA)"
|
||
|
|
"%DSLOG%",2,"D:P(A;CIOI;GA;;;SY)(A;CIOI;GA;;;BA)(A;OICIIO;GA;;;CO)(A;CI;0x100004;;;LS)"
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
;Sysvol. Engine resolves via registry.
|
||
|
|
;---------------------------------------------------------------------------------------------
|
||
|
|
"%Sysvol%",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
||
|
|
"%Sysvol%\domain\policies",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)(A;CIOI;GRGWGXSD;;;PA)"
|