removing the everyone group from drives.

The everyone group is not a threat to anything. It is just a group that the system creates when you load the OS. Now, it can be a problem if you have the everyone group with full control and assigned to every user. If that is the case then you are overriding the permissions that you assign each user. It will not cause you any strife however if it is not assigned to anyone or any OU that you do not want it in. It is a waste of your time to delete it because it really won't hurt anything unless it is set up wrong

-duck

By itself the Everyone group is not a problem, but in a good security environment it is removed or disabled.

What you should do is set up groups for people based on their business needs and then assign servers according to the business needs. The groups are then assigned access to the relevant parts of the servers as per their business needs and all other groups, users and services removed or disabled. This is best managed through the User/Groups area. A single User can belong to more than one Group and thus have access to multiple areas.

As general rule people should only have execute or write or change access to the areas where they are likely to be storing information, or running programs.

The tech you talked to has absolutely NO idea what they are talking about and should be shot for doling out that advice.

The "everyone" group is an extremely dangerous group. Everyone means "Everyone"!!!! Regardless of where you come from.

This is a security faux pax, and should be never enabled.

On the root drives, no one other than "local admins" and "system" should have full control. The everyone group should be removed. This protects the root drives from having files uploaded to them.

The system root is a little harder to protect, you have to know what you are doing in there. But at the very least, if this is a server, get rid of the inetpub folder, and replace the permissions on cmd.exe to only allow system and local admins.

If you notice I keep saying local admins. This is regardles of whether or not it is in a domain. Because the domain admins are automatically added to the local admins group. But not vice versa. So you don't want to screw your self by removing the local admins group.

Also, never, ever, ever, add a single user account to folders other than their personal folders. Always use groups. Even if you only have 1 user in the group. This helps combat SID enumeration.

Always use domain users. Not even authenticated users because it is misleading.

Taking my advice is totally up to you, as I am sure that many people here will disagree with me. But i'm also not the run of the mill poster or "tech". I'm a actual security professional who is charged with securing corporate networks and penetration testing. Following the MS's tech's advice is sheer suicide in the security world.