Restricting SYSTEM's file permissions?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

In a world of holes, worms, hackers & crackers, viruses and malicious code it seems a good idea to restrict also the operating system's file access to something lower than Full Control. Tried with SYSTEM having only Read Access on my data disks and everything worked fine, of course. But then a question arose: If the file system gets corrupted and I need to run ChkDsk /F (on next boot) to fix errors, the command checks the security descriptors and presumably also tries to correct them if they are corrupted. Logically thinking, ChkDsk /F should run under SYSTEM account and the SYSTEM account obviously needs Modify Access on both folders and files as well as Change Permissions and Take Ownership to cover the worst situations. Which leaves only the Execute and Delete Folders And Files as permissions to deny - possibly so. It's all just my reasoning, so could anyone provide me with facts?
 
Take a look at:
http://support.microsoft.com/?id=244600
Ralph [MSFT]

"This posting is provided "AS IS" with no warranties, and confers no

rights."



Matti said:
In a world of holes, worms, hackers & crackers, viruses and malicious code
Click to expand...
it seems a good idea to restrict also the operating system's file access to
something lower than Full Control. Tried with SYSTEM having only Read Access
on my data disks and everything worked fine, of course. But then a question
arose: If the file system gets corrupted and I need to run ChkDsk /F (on
next boot) to fix errors, the command checks the security descriptors and
presumably also tries to correct them if they are corrupted. Logically
thinking, ChkDsk /F should run under SYSTEM account and the SYSTEM account
obviously needs Modify Access on both folders and files as well as Change
Permissions and Take Ownership to cover the worst situations. Which leaves
only the Execute and Delete Folders And Files as permissions to deny -
possibly so. It's all just my reasoning, so could anyone provide me with
facts?
 
Back
Top