You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
532 lines
31 KiB
532 lines
31 KiB
@*:This file defines default security settings.
|
|
@*:Please do not edit. Instead, email kirksol with the requested change.
|
|
@*:Thanks!
|
|
; Copyright (c) Microsoft Corporation. All rights reserved.
|
|
;
|
|
; Security Configuration Template for Security Configuration Manager
|
|
;
|
|
; Template Name: DefltWK.INF
|
|
; Template Version: 05.10.DP.0000
|
|
;
|
|
; Default Security for NT 5.1 Personal Edition.
|
|
; DefltP.INF is copied to DefltWK.INF on the Personal SKU as specified in Layout.inf for personal.
|
|
|
|
[Profile Description]
|
|
%SCEDefltProfileDescription%
|
|
|
|
[version]
|
|
signature="$CHICAGO$"
|
|
revision=1
|
|
|
|
[System Access]
|
|
;----------------------------------------------------------------
|
|
;Account Policies - Password Policy
|
|
;----------------------------------------------------------------
|
|
MinimumPasswordAge = 0
|
|
MaximumPasswordAge = -1
|
|
MinimumPasswordLength = 0
|
|
PasswordComplexity = 0
|
|
PasswordHistorySize = 0
|
|
RequireLogonToChangePassword = 0
|
|
ClearTextPassword = 0
|
|
LSAAnonymousNameLookup = 0
|
|
EnableGuestAccount = 0
|
|
|
|
;----------------------------------------------------------------
|
|
;Account Policies - Lockout Policy
|
|
;----------------------------------------------------------------
|
|
LockoutBadCount = 0
|
|
;ResetLockoutCount = 30
|
|
;LockoutDuration = 30
|
|
|
|
;----------------------------------------------------------------
|
|
;Local Policies - Security Options
|
|
;----------------------------------------------------------------
|
|
;DC Only
|
|
;ForceLogoffWhenHourExpire = 0
|
|
|
|
;NewAdministatorName =
|
|
;NewGuestName =
|
|
;SecureSystemPartition
|
|
|
|
;----------------------------------------------------------------
|
|
;Event Log - Log Settings
|
|
;----------------------------------------------------------------
|
|
;Audit Log Retention Period:
|
|
;0 = Overwrite Events As Needed
|
|
;1 = Overwrite Events As Specified by Retention Days Entry
|
|
;2 = Never Overwrite Events (Clear Log Manually)
|
|
|
|
[System Log]
|
|
MaximumLogSize = 8192
|
|
AuditLogRetentionPeriod = 0
|
|
RestrictGuestAccess = 1
|
|
|
|
[Security Log]
|
|
MaximumLogSize = 8192
|
|
AuditLogRetentionPeriod = 0
|
|
RestrictGuestAccess = 1
|
|
|
|
[Application Log]
|
|
MaximumLogSize = 8192
|
|
AuditLogRetentionPeriod = 0
|
|
RestrictGuestAccess = 1
|
|
|
|
;----------------------------------------------------------------------
|
|
; Local Policies\Audit Policy
|
|
;----------------------------------------------------------------------
|
|
[Event Audit]
|
|
AuditSystemEvents = 3
|
|
AuditObjectAccess = 0
|
|
AuditPrivilegeUse = 0
|
|
AuditPolicyChange = 3
|
|
AuditAccountManage = 3
|
|
AuditProcessTracking = 0
|
|
AuditAccountLogon = 3
|
|
AuditLogonEvents = 3
|
|
|
|
|
|
;----------------------------------------------------------------
|
|
;Registry Values
|
|
;----------------------------------------------------------------
|
|
[Registry Values]
|
|
; Registry value name in full path = Type, Value
|
|
; REG_SZ ( 1 )
|
|
; REG_EXPAND_SZ ( 2 ) // with environment variables to expand
|
|
; REG_BINARY ( 3 )
|
|
; REG_DWORD ( 4 )
|
|
; REG_MULTI_SZ ( 7 )
|
|
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\AuditBaseObjects=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCreds=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\ForceGuest=4,1
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing=3,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse=4,1
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4,2
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\NoDefaultAdminOwner=4,1
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM=4,1
|
|
|
|
;Domain Controllers Only
|
|
;MACHINE\System\CurrentControlSet\Control\Lsa\SubmitControl=4,0
|
|
|
|
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,0
|
|
|
|
MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel\ObCaseInsensitive=4,1
|
|
MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,0
|
|
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
|
|
|
|
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,0
|
|
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
|
|
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1
|
|
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect=4,15
|
|
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess=4,1
|
|
|
|
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
|
|
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0
|
|
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4,0
|
|
|
|
MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity=4,1
|
|
|
|
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4,0
|
|
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\MaximumPasswordAge=4,30
|
|
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4,1
|
|
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4,1
|
|
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4,1
|
|
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireStrongKey=4,0
|
|
|
|
;Potential to take on different values during and after setup
|
|
;MACHINE\Software\Microsoft\Driver Signing\Policy=3,1
|
|
;MACHINE\Software\Microsoft\Non-Driver Signing\Policy=3,0
|
|
|
|
|
|
;MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,1
|
|
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,0
|
|
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption=1,""
|
|
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=7,""
|
|
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ScForceOption=4,0
|
|
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4,1
|
|
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UndockWithoutLogon=4,1
|
|
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0
|
|
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,0
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,0
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,0
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,10
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4,0
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1,0
|
|
|
|
MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled=4,0
|
|
|
|
;----------------------------------------------------------------------
|
|
; Privileges & Rights
|
|
;----------------------------------------------------------------------
|
|
;
|
|
;World S-1-1-0
|
|
;
|
|
;NT Authority S-1-5
|
|
;LOCAL_SERVICE 19
|
|
;NETWORK_SERVICE 20
|
|
;
|
|
;Built-In Domain SubAuthority = S-1-5-32
|
|
;ADMINISTRATORS 544
|
|
;USERS 545
|
|
;GUESTS 546
|
|
;POWER_USERS 547
|
|
;ACCOUNT_OPS 548
|
|
;SYSTEM_OPS 549
|
|
;PRINT_OPS 550
|
|
;BACKUP_OPS 551
|
|
;REPLICATOR 552
|
|
;RAS_SERVERS 553
|
|
;PREW2KCOMPACCESS 554
|
|
;REMOTE_DESKTOP_USERS 555
|
|
;NETWORK_CONFIGURATION_OPS 556
|
|
;
|
|
[Privilege Rights]
|
|
SeAssignPrimaryTokenPrivilege = *S-1-5-19, *S-1-5-20
|
|
SeAuditPrivilege = *S-1-5-19, *S-1-5-20
|
|
SeBatchLogonRight =
|
|
SeBackupPrivilege = *S-1-5-32-544
|
|
SeChangeNotifyPrivilege = *S-1-5-32-544, *S-1-5-32-545, *S-1-1-0
|
|
SeCreatePagefilePrivilege = *S-1-5-32-544
|
|
SeCreateGlobalPrivilege = *S-1-5-6, *S-1-5-32-544
|
|
SeCreatePermanentPrivilege =
|
|
SeCreateTokenPrivilege =
|
|
SeDebugPrivilege = *S-1-5-32-544
|
|
SeImpersonatePrivilege = *S-1-5-6, *S-1-5-32-544
|
|
SeIncreaseBasePriorityPrivilege = *S-1-5-32-544
|
|
SeIncreaseQuotaPrivilege = *S-1-5-32-544, *S-1-5-19, *S-1-5-20
|
|
SeInteractiveLogonRight = *S-1-5-32-544, *S-1-5-32-545, %SceInfGuest%
|
|
SeLoadDriverPrivilege = *S-1-5-32-544
|
|
SeLockMemoryPrivilege =
|
|
SeMachineAccountPrivilege =
|
|
SeManageVolumePrivilege = *S-1-5-32-544
|
|
SeNetworkLogonRight = %SceInfGuest%, *S-1-5-32-545
|
|
SeProfileSingleProcessPrivilege = *S-1-5-32-544
|
|
SeRemoteInteractiveLogonRight = *S-1-5-32-544
|
|
SeRemoteShutdownPrivilege = *S-1-5-32-544
|
|
SeRestorePrivilege = *S-1-5-32-544
|
|
SeSecurityPrivilege = *S-1-5-32-544
|
|
SeServiceLogonRight =
|
|
SeShutdownPrivilege = *S-1-5-32-544, *S-1-5-32-545
|
|
SeSystemEnvironmentPrivilege = *S-1-5-32-544
|
|
SeSystemProfilePrivilege = *S-1-5-32-544
|
|
SeSystemTimePrivilege = *S-1-5-32-544
|
|
SeTakeOwnershipPrivilege = *S-1-5-32-544
|
|
SeTcbPrivilege =
|
|
;
|
|
SeDenyInteractiveLogonRight = %SceInfGuest%
|
|
SeDenyBatchLogonRight =
|
|
SeDenyServiceLogonRight =
|
|
SeDenyNetworkLogonRight = %SceInfGuest%
|
|
SeDenyRemoteInteractiveLogonRight =
|
|
;
|
|
SeUndockPrivilege = *S-1-5-32-544, *S-1-5-32-545
|
|
SeSyncAgentPrivilege =
|
|
SeEnableDelegationPrivilege =
|
|
|
|
[Group Membership]
|
|
%SceInfUsers%__Memberof =
|
|
%SceInfUsers%__Members = %SceInfAuthUsers%,%SceInfInteractive%
|
|
|
|
|
|
[Service General Setting]
|
|
;Note: startup type should not be configured during setup\dcpromo.
|
|
;autostarted on workstations and servers, standalone or joined - Remove PU ability to stop\start.
|
|
Browser,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
Dhcp,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRRC;;;NO)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
TrkWks,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
Dnscache,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRRC;;;NO)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
Eventlog,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
PolicyAgent,,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
dmserver,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
Messenger,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
PlugPlay,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
Spooler,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
ProtectedStorage,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
RpcSs,,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
NtmsSvc,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
seclogon,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
SamSs,,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
lanmanserver,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
SENS,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
Schedule,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
Sysmonlog,,"D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCRPLOCR;;;LU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
LmHosts,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
LanmanWorkstation,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
RemoteRegistry,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
|
|
;Not autostarted, but non-default DACL - Remove PU ability to change template
|
|
ClipSrv,,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
NetDDE,,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
NetDDEdsdm,,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
EventSystem,,"D:(A;;CCLCSWRPLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
|
|
;Not autostarted if machine is standalone
|
|
Netlogon,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
W32Time,,"D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
|
|
;Not autostarted if Wksta
|
|
;Alerter,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
;MSDTC,,"D:(A;;CCLCSWRPLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLORC;;;NS)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
|
|
;Server Only Services
|
|
;Dfs,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
;LicenseService,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
|
|
;IIS Specific Services - Leave them alone
|
|
;IISADMIN,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
;W3SVC,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
;MSFTPSVC,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
;SMTPSVC,,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
|
|
|
|
[Registry Keys]
|
|
|
|
"MACHINE\Software",2,"D:P(A;CI;GR;;;BU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
|
|
;Same as parent, but this is the target of a symlink - set explicitly.
|
|
"MACHINE\SOFTWARE\Classes",2,"D:P(A;CI;GR;;;BU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
|
|
"MACHINE\SOFTWARE\Microsoft\Cryptography\Calais",2,"D:AR(A;CI;GRGWSD;;;LS)"
|
|
|
|
"MACHINE\SOFTWARE\Microsoft\NetDDE",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider",1,"D:AR"
|
|
|
|
;The following keys do not exist when we run
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy",1,"D:AR"
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer",1,"D:AR"
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",1,"D:AR"
|
|
"MACHINE\SOFTWARE\Microsoft\MSDTC",1,"D:AR"
|
|
|
|
;Different than parent
|
|
"MACHINE\SOFTWARE\Microsoft\wbem",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GA;;;NS)(A;CI;GR;;;BU)"
|
|
"MACHINE\SOFTWARE\Microsoft\wbem\CIMOM",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GR;;;BU)"
|
|
"MACHINE\SOFTWARE\Microsoft\wbem\Transports",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GR;;;BU)"
|
|
"MACHINE\SOFTWARE\Microsoft\wbem\ESS",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GR;;;BU)"
|
|
"MACHINE\SOFTWARE\Microsoft\wbem\FWD",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GR;;;BU)"
|
|
|
|
|
|
"MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony",2,"D:P(A;CIOI;GR;;;BU)(A;CIOI;GRGWSD;;;PU)(A;CIOI;GA;;;NS)(A;CIOI;GA;;;LS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GR;;;LS)(A;CI;GR;;;NS)(A;CI;GR;;;LU)(A;CI;GR;;;MU)"
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009",1,"D:AR"
|
|
"MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WbemPerf",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;GR;;;LS)(A;CI;GR;;;NS)(A;CI;GR;;;LU)(A;CI;GR;;;MU)"
|
|
|
|
|
|
"MACHINE\System",2,"D:P(A;CI;GR;;;BU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
|
|
"MACHINE\SYSTEM\Clone",1,"D:AR"
|
|
|
|
"MACHINE\SYSTEM\ControlSet001",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet002",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet003",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet004",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet005",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet006",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet007",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet008",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet009",1,"D:AR"
|
|
"MACHINE\SYSTEM\ControlSet010",1,"D:AR"
|
|
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\Class",0,"D:AR"
|
|
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout",2,"D:(A;CI;GR;;;WD)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts",2,"D:(A;CI;GR;;;WD)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Audit",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\LSA\JD",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Skew1",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\LSA\GBG",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Data",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg",2,"D:P(A;CI;GA;;;BA)(A;CI;GR;;;LS)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security",2,"D:P(A;CI;GR;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
|
|
"MACHINE\SYSTEM\CurrentControlSet\Enum",1,"D:AR"
|
|
|
|
"MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles",1,"D:AR"
|
|
|
|
;Set security subkey permissions for those services created via default hives
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@*:Fix for 477845 causes regression for 32625
|
|
;"MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@*:We still can add a SACL to it though.
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security",2,"S:AR(AU;OICISAFA;DCLCSDWDWO;;;WD)"
|
|
@@:@6:"MACHINE\SYSTEM\CurrentControlSet\Services\IASJet\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\NetDDE\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\NetDDEdsdm\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\Samss\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
|
|
;Set security subkey permissions for those services created in GUI-mode setup before SCE runs
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\IREnum\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\STISvc\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\WMI\Security",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
|
|
"MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries",2,"D:(A;CI;GA;;;NS)(A;CI;CCDCLCSWSDRC;;;LU)"
|
|
|
|
"USERS\.DEFAULT",2,"D:P(A;CI;GR;;;BU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"USERS\.DEFAULT\Software\Microsoft\NetDDE",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)"
|
|
"USERS\.DEFAULT\SOFTWARE\Microsoft\Protected Storage System Provider",1,"D:AR"
|
|
"USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\ProtectedRoots",1,"D:AR"
|
|
|
|
[File Security]
|
|
|
|
;---------------------------------------------------------------------------------------
|
|
;x86 Boot Files
|
|
;---------------------------------------------------------------------------------------
|
|
@@:@i:"%BootDrive%\boot.ini",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@@:@i:"%BootDrive%\ntdetect.com",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@@:@i:"%BootDrive%\ntldr",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@@:@i:"%BootDrive%\ntbootdd.sys",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@@:@i:"%BootDrive%\autoexec.bat",2,"D:P(A;;GRGX;;;BU)(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@@:@i:"%BootDrive%\config.sys",2,"D:P(A;;GRGX;;;BU)(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
|
|
;---------------------------------------------------------------------------------------
|
|
;amd64 Boot Files
|
|
;---------------------------------------------------------------------------------------
|
|
@@:@a:"%BootDrive%\boot.ini",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@@:@a:"%BootDrive%\ntdetect.com",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
@@:@a:"%BootDrive%\ntldr",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
|
|
;---------------------------------------------------------------------------------------
|
|
;System Drive
|
|
;---------------------------------------------------------------------------------------
|
|
;SetupSecurity will contain the new root acl. Ignore docs and settings if it's reapplied (e.g. on conversion from FAT)
|
|
"%SystemDrive%\Documents and Settings",1,"D:AR"
|
|
; Directories that might not exist when security is applied; but are listed here
|
|
; so that they get secured correctly on converting the file system to NTFS
|
|
"%SystemDrive%\perflogs",2,"D:P(A;CIOI;GRGX;;;MU)(A;CIOI;GRGWGXSDRC;;;NS)(A;CIOI;GRGWGXSDRC;;;LU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDrive%\System Volume Information",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDrive%\wmpub",2,"D:P(A;CIOI;GRGWGXSD;;;BU)(A;CIOI;GRGWGXSD;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
|
|
;---------------------------------------------------------------------------------------------
|
|
;ProgramFiles
|
|
;---------------------------------------------------------------------------------------------
|
|
|
|
"%SceInfProgramFiles%",2,"D:P(A;CIOI;GRGX;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SceInfProgramFiles%\WindowsUpdate",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
|
|
|
|
;---------------------------------------------------------------------------------------------
|
|
;System Root (Typically \WINDOWS)
|
|
;---------------------------------------------------------------------------------------------
|
|
"%SystemRoot%",2,"D:P(A;CIOI;GRGX;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
|
|
;Differences from parent
|
|
"%SystemRoot%\Debug",2,"D:P(A;;GX;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemRoot%\Debug\UserMode",2,"D:PAR(A;;0x00100023;;;BU)(A;OIIO;0x00100006;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
|
"%SystemRoot%\repair",2,"D:P(A;CI;GRGX;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemRoot%\Temp",2,"D:P(A;CI;0x100026;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemRoot%\Web\printers\prtcabs",2,"D:(A;CIOI;GRGXGWSD;;;NS)"
|
|
|
|
;Directories that do not exist when security applied during clean-install - Creator specifies directory security.
|
|
;We explicitly ignore so as not to whack the component-specified DIRECTORY security on upgrade or reapplication of defaults.
|
|
"%SystemRoot%\CSC",1,"D:AR"
|
|
|
|
;Profiles folder (typically %SystemRoot%\Profiles)
|
|
"%Profiles%",1,"D:AR"
|
|
|
|
; Directories that might not exist when security is applied; but are listed here
|
|
; so that they get secured correctly on converting the file system to NTFS
|
|
"%SystemRoot%\Installer",2,"D:P(A;CIOI;GRGX;;;WD)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
|
"%SystemRoot%\PCHEALTH\HELPCTR",2,"D:P(A;CIOI;GRGX;;;WD)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemRoot%\PCHEALTH\HELPCTR\Config",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemRoot%\PCHEALTH\HELPCTR\DataColl",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemRoot%\PCHEALTH\HELPCTR\PackageStore",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemRoot%\prefetch",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
|
"%SystemRoot%\Registration",2,"D:P(A;OI;GRGX;;;WD)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
|
"%SystemRoot%\Registration\CRMLog",0,"D:P(A;;0x1200ab;;;BU)(A;OIIO;GRGWSD;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
|
"%SystemRoot%\Tasks",2,"D:P(A;;0x1200ab;;;AU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
|
|
;Directories that do not exist when security applied during setup - Creator does not specify directory security.
|
|
;Creator should specify FILE security in optional component INF that gets applied on clean-install AND upgrade.
|
|
;Omit (rather than ignore) to allow component-specified file security to be set on reapplication of defaults.
|
|
;Use MARTA (rather than omit) for any components that set protected run-time security.
|
|
;"%SystemRoot%\Downloaded Program Files",0,"D:AR"
|
|
;"%SystemRoot%\Offline Web Pages",0,"D:AR"
|
|
;"%SystemRoot%\IME",0,"D:AR"
|
|
;"%SystemRoot%\mww32",0,"D:AR"
|
|
;"%SystemRoot%\PCHEALTH",0,"D:AR"
|
|
;"%SystemRoot%\SchCache",0,"D:AR"
|
|
;"%SystemRoot%\srchasst",0,"D:AR"
|
|
|
|
"%SystemDirectory%",2,"D:P(A;CIOI;GRGX;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
|
|
;Differences from parent
|
|
"%SystemDirectory%\config",2,"D:P(A;CI;GRGX;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
;Profile for system account - moved from Docs and Settings in Whistler. Creator specifies security.
|
|
"%SystemDirectory%\config\systemprofile",1,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
|
"%SystemDirectory%\dllcache",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\ias",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\LogFiles\ShutDown",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
|
"%SystemDirectory%\setup",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\wbem\mof",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\wbem\repository",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\wbem\logs",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)(A;CIOI;GRGXGW;;;NS)(A;CIOI;GRGXGW;;;LS)"
|
|
"%SystemDirectory%\wbem\AutoRecover",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%Systemdirectory%\wpa.bak",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
"%Systemdirectory%\wpa.dbl",2,"D:P(A;;GA;;;BA)(A;;GA;;;SY)"
|
|
;So spooler can load drivers while impersonating the forced Guest
|
|
"%SystemDirectory%\spool\drivers",2,"D:(A;CIOI;GRGX;;;WD)"
|
|
|
|
;Directories that do not exist when security applied during clean-install - Creator specifies directory security.
|
|
;We explicitly ignore so as not to whack the component-specified DIRECTORY security on upgrade or reapplication of defaults.
|
|
"%SystemDirectory%\appmgmt",1,"D:AR"
|
|
"%SystemDirectory%\DTCLog",1,"D:AR"
|
|
"%SystemDirectory%\GroupPolicy",1,"D:AR"
|
|
"%SystemDirectory%\NTMSData",1,"D:AR"
|
|
"%SystemDirectory%\ReinstallBackups",1,"D:AR"
|
|
"%SystemDirectory%\repl",1,"D:AR"
|
|
|
|
; Directories that might not exist when security is applied; but are listed here
|
|
; so that they get secured correctly on converting the file system to NTFS
|
|
"%SystemDirectory%\com\dmp",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)"
|
|
"%SystemDirectory%\FxsTmp",2,"D:P(A;;0x100003;;;BU)(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICIIO;FA;;;CO)"
|
|
"%SystemDirectory%\LLS",2,"D:(A;CIOI;GA;;;NS)"
|
|
"%SystemDirectory%\LLS\CPL.CFG",2,"D:P(A;CIOI;GA;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\LLS\LlsCert.LLS",2,"D:P(A;CIOI;GA;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\LLS\LlsMap.LLS",2,"D:P(A;CIOI;GA;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\LLS\LlsUser.LLS",2,"D:P(A;CIOI;GA;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\LogFiles\Fax\Incoming",2,"D:P(A;CIOI;GA;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\LogFiles\Fax\Outgoing",2,"D:P(A;CIOI;GA;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\LogFiles\wms",2,"D:P(A;CIOI;GRGX;;;BU)(A;CIOI;GRGWGXSD;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\LServer",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\msdtc",2,"D:P(A;OICI;GRGWGX;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\msmq",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\spool\printers",2,"D:P(A;CI;0x1000ae;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\tssesdir",2,"D:P(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
"%SystemDirectory%\Windows media",2,"D:P(A;CIOI;GRGX;;;BU)(A;CIOI;GRGWGXSD;;;NS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
|
|
|
|
;Directories that do not exist when security applied during setup - Creator does not specify directory security.
|
|
;Creator should specify FILE security in optional component INF that gets applied on clean-install AND upgrade.
|
|
;Omit (rather than ignore) to allow component-specified file security to be set on reapplication of defaults.
|
|
;Use MARTA (rather than omit) for any components that set protected run-time security.
|
|
;"%SystemDirectory%\Cache",0,"D:AR"
|
|
;"%SystemDirectory%\Com",0,"D:AR"
|
|
;"%SystemDirectory%\clients",0,"D:AR"
|
|
;"%SystemDirectory%\inetsrv",0,"D:AR"
|
|
;"%SystemDirectory%\Microsoft",0,"D:AR"
|
|
;"%SystemDirectory%\npp",0,"D:AR"
|
|
;"%SystemDirectory%\oobe",0,"D:AR"
|
|
;"%SystemDirectory%\restore",0,"D:AR"
|
|
;"%SystemDirectory%\reminst",0,"D:AR"
|
|
;"%SystemDirectory%\rocket",0,"D:AR"
|
|
;"%SystemDirectory%\usmt",0,"D:AR"
|
|
|