deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 14:27:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'refs/remotes/origin/master' into jd-sandbox

Browse Source
This commit is contained in:
jdeckerMS 2016-08-30 16:41:01 -07:00
commit b7a1519c8c
1 changed files with 21 additions and 128 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

149
mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md
View File

@ -33,143 +33,36 @@ Because settings packages might contain personal information, you should take ca
1. Set the following share-level SMB permissions for the setting storage location folder.
<table>
<colgroup>
<col width="50%" />
<col width="50%" />
</colgroup>
<thead>
<tr class="header">
<th align="left">User account</th>
<th align="left">Recommended permissions</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td align="left"><p>Everyone</p></td>
<td align="left"><p>No permissions</p></td>
</tr>
<tr class="even">
<td align="left"><p>Security group of UE-V</p></td>
<td align="left"><p>Full control</p></td>
</tr>
</tbody>
</table>
 
| User account | Recommended permissions |
| - | - |
| Everyone | No permissions |
|Security group of UE-V | Full control |
2. Set the following NTFS file system permissions for the settings storage location folder.
<table>
<colgroup>
<col width="33%" />
<col width="33%" />
<col width="33%" />
</colgroup>
<thead>
<tr class="header">
<th align="left">User account</th>
<th align="left">Recommended permissions</th>
<th align="left">Folder</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td align="left"><p>Creator/Owner</p></td>
<td align="left"><p>No permissions</p></td>
<td align="left"><p>No permissions</p></td>
</tr>
<tr class="even">
<td align="left"><p>Domain Admins</p></td>
<td align="left"><p>Full control</p></td>
<td align="left"><p>This folder, subfolders, and files</p></td>
</tr>
<tr class="odd">
<td align="left"><p>Security group of UE-V users</p></td>
<td align="left"><p>List folder/read data, create folders/append data</p></td>
<td align="left"><p>This folder only</p></td>
</tr>
<tr class="even">
<td align="left"><p>Everyone</p></td>
<td align="left"><p>Remove all permissions</p></td>
<td align="left"><p>No permissions</p></td>
</tr>
</tbody>
</table>
 
| User account | Recommended permissions | Folder |
| - | - | - |
| Creator/Owner | No permissions | No permissions |
| Domain Admins | Full control | This folder, subfolders, and files |
| Security group of UE-V users | List folder/read data, create folders/append data | This folder only |
| Everyone | Remove all permissions | No permissions |
3. Set the following share-level SMB permissions for the settings template catalog folder.
<table>
<colgroup>
<col width="50%" />
<col width="50%" />
</colgroup>
<thead>
<tr class="header">
<th align="left">User account</th>
<th align="left">Recommend permissions</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td align="left"><p>Everyone</p></td>
<td align="left"><p>No permissions</p></td>
</tr>
<tr class="even">
<td align="left"><p>Domain computers</p></td>
<td align="left"><p>Read permission Levels</p></td>
</tr>
<tr class="odd">
<td align="left"><p>Administrators</p></td>
<td align="left"><p>Read/write permission levels</p></td>
</tr>
</tbody>
</table>
| User account | Recommend permissions |
| - | - |
| Everyone | No permissions |
| Domain computers | Read permission Levels |
| Administrators | Read/write permission levels |
 
4. Set the following NTFS permissions for the settings template catalog folder.
<table>
<colgroup>
<col width="33%" />
<col width="33%" />
<col width="33%" />
</colgroup>
<thead>
<tr class="header">
<th align="left">User account</th>
<th align="left">Recommended permissions</th>
<th align="left">Apply to</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td align="left"><p>Creator/Owner</p></td>
<td align="left"><p>Full control</p></td>
<td align="left"><p>This folder, subfolders, and files</p></td>
</tr>
<tr class="even">
<td align="left"><p>Domain Computers</p></td>
<td align="left"><p>List folder contents and Read permissions</p></td>
<td align="left"><p>This folder, subfolders, and files</p></td>
</tr>
<tr class="odd">
<td align="left"><p>Everyone</p></td>
<td align="left"><p>No permissions</p></td>
<td align="left"><p>No permissions</p></td>
</tr>
<tr class="even">
<td align="left"><p>Administrators</p></td>
<td align="left"><p>Full Control</p></td>
<td align="left"><p>This folder, subfolders, and files</p></td>
</tr>
</tbody>
</table>
 
| User account | Recommended permissions | Apply to |
| - | - | - |
| Creator/Owner | Full control | This folder, subfolders, and files |
| Domain Computers | List folder contents and Read permissions | This folder, subfolders, and files|
| Everyone| No permissions| No permissions|
| Administrators| Full Control| This folder, subfolders, and files|
### Use Windows Server as of Windows Server 2003 to host redirected file shares