IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
directories contained in that directory. If restrictions on a subdirectory are
required, as in the above example, this cannot be achieved by means of share
permissions but only with the aid of the NTFS permissions (see S 4.53
Restrictive allocation of access rights to files and directories under Windows
NT).
When a directory located on an NTFS data medium is shared, in addition to
the share permission the NTFS permissions also apply to that directory and to
the files and subdirectories that it contains. In each case, the most restrictive
permission is the one that applies. If, for example, a user possesses the "Read"
share permission for the shared directory, but on the other hand only the
"Display" NTFS permission for the same directory, his access right is
restricted to "Display". Using the NTFS permission it is therefore also
possible to assign access rights individually to files and subdirectories (for
more details see also S 4.53).
Share permissions obtained by belonging to groups are cumulative; this means
that if a user is a member of various groups to which different share
permissions have been granted in relation to a particular directory, the
furthest-ranging permission applies for that user. There is an exception to this
rule, however: the "No Access" share permission is dominant over all other
share permissions.
Example: Let us assume that D:\RESULTS is shared. User Smith is a member
of group A and of group B. Group A is assigned "Read" permission and group
B "Full Access" permission to the above shared directory. In this case the
"Full Access" permission is the decisive permission for user Smith. If user
Smith is now also made a member of group C, for which the "No Access"
share permission has been assigned for the shared directory D:\RESULTS,
user Smith is denied access to this directory via the network. If this is not the
desired effect, all the administrator can do is check which groups have been
assigned the "No Access" share permission to the resource and find out to
which of these groups the user concerned belongs. The user must then be
removed from the relevant group.
Furthermore, it should be noted that Windows NT always shares the root
directories of all disks together with the Windows directory %SystemRoot%
(generally C:\WINNT) for administrative accesses. The access rights to these
special releases cannot be changed and are restricted to the user group
"Administrators". These releases are not directly visible, as they have release
names along the lines of "Disk name$", thus for example "C$" or the name
"ADMIN$".
As a result there is a danger that
- someone can try out the administrator user name and password, or
- an administrator can secretly access users’ computers at any time.
If this feature for facilitating workstation management is required, a decision
must be made as to whether administrators should use the same password for
all workstations under their jurisdiction. A single password is easier to
remember but, if detected, would allow intruders to access all workstations.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000