V-277998

Discussion

Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN25-SO-000240). Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124

Check Content

The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN25-SO-000240).

Review the permissions for the system drive's root directory (usually C:\). Nonprivileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. Individual accounts must not be used to assign permissions.

If permissions are not as restrictive as the default permissions listed below, this is a finding.

Viewing in File Explorer:

View the Properties of the system drive's root directory.

Select the "Security" tab, and then click "Advanced".

Default permissions:
C:\
Type - "Allow" for all
Inherited from - "None" for all

Principal - Access - Applies to

SYSTEM - Full control - This folder, subfolders, and files
Administrators - Full control - This folder, subfolders, and files
Users - Read & execute - This folder, subfolders, and files
Users - Create folders/append data - This folder and subfolders  (Note: "Authenticated Users" is acceptable)
Users - Create files/write data - Subfolders only   (Note: "Authenticated Users" is acceptable)
CREATOR OWNER - Full Control - Subfolders and files only

Alternately, use icacls:

1. Open "Command Prompt (Admin)".
2. Enter "icacls" followed by the directory:

"icacls c:\"

The following results must be displayed:

c:\
NT AUTHORITY\SYSTEM:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
BUILTIN\Users:(OI)(CI)(RX)
BUILTIN\Users:(CI)(AD)
BUILTIN\Users:(CI)(IO)(WD)
*NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M)
*NT AUTHORITY\Authenticated Users:(AD)
CREATOR OWNER:(OI)(CI)(IO)(F)
**Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW)
Successfully processed 1 files; Failed processing 0 files

* - Some system's configurations managed via a CSP (e.g. via Azure) may display minor differences (more restrictive) for Users or Authenticated Users.
** - Mandatory Label is part of the system access control list (SACL) and may not display for some (nonstandard) implementations.