Windows Forum

Ask something
Discussion Locked

Windows 2000 file security

0 helpful
5 replies

by gdemoura

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My company has many laptops with NTFS disk format.
For the C partition I setup the permissions at the "Sharing" level (Full control for domain admin only) but I left Full control access for everyone in the "Security" tab. Am I taking any risks in terms of security. Is there a hole in my laptop users security.

Thanks

5 replies

by jrricha

The main thing is that anyone at the console-- i.e. the laptop itself, has Full Control. The 'Sharing' tab controls access from the network only, while the 'Security' tab controls the NTFS permissions on the hard drives themselves. So, if a user is accessing the drive over the network, they will be restricted, but if a user is sitting in front of the laptop typing on it, they will not be.

by banyanman

Another thing you want to look at as well is if you only want domain admins accessing the c drives remotely then do nothing with the laptops as far as sharing is concerned. By default Windows NT, 2000, XP all add what is called admin shares that are hidden. For example \\computername\c$ is the default share for the C drive and all other drives are shared as well with the exception of the CDROM. The default share permissions are set for administrators of the local machine to have access only. By default joining the pc to the domain puts the domain admins in the local administrators group. Doing it the way you are describing has no risk but it is a lot of unnecessary work.

This discussion is closed to new replies.