[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Securing the Sysvol Share - Active Directory 2012

Posted on 2013-01-02
5
Medium Priority
?
969 Views
Last Modified: 2013-01-02
Experts,

I was wondering if there is a way to secure or Remove the Sysvol share from Windows 2012 Active Directory.  My end users are not tech savy, but it is pretty scary to see that anyone in my network can \\Myserver\sysvol and see the share, access and change.

Are there any recommendations that I can use so that my end users can not see this share without impacting my brand new installation of windows 2012 active directory?

Thank you
0
Comment
Question by:RandallVillalobos
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 18

Accepted Solution

by:
Sarang Tinguria earned 800 total points
ID: 38737512
Sysvol holds the policies and logon scripts defined for domain
It should be shared on DC's However only Read only access should be give on shares which is required in order to get policies applied

There are no security breaches if the sysvol is shared with default permissions and normal users are not given administative rights
0
 
LVL 7

Assisted Solution

by:waleeda
waleeda earned 800 total points
ID: 38737531
no one can change anything in the sysvol folder as all authenticated user has read/execute permission only.

please see the below MS KB
http://support.microsoft.com/kb/812538
0
 

Author Comment

by:RandallVillalobos
ID: 38737555
Hello,

In order to understand correctly, my authenticated users will have read and execute access to the Sysvol folder?  No way around it?

Thanks!
0
 
LVL 18

Expert Comment

by:Sarang Tinguria
ID: 38737576
Yes, its mandatory to have it in order AD & FRS replication to work correctly ....to policy to get applied on clients successfuly
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 400 total points
ID: 38737641
They shouldn't be able to change anything.   This is why it is critical to not store passwords in scripts in sysvol.  I've seen scripts that contain passwords of admin accounts.    Like you said most users are not savvy enough to even know that sysvol exists but we worry about the smart attackers.


Thanks

Mike
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Microsoft Office 365 is a subscriptions based service which includes services like Exchange Online and Skype for business Online. These services integrate with Microsoft's online version of Active Directory called Azure Active Directory.
It’s time for spooky stories and consuming way too much sugar, including the many treats we’ve whipped for you in the world of tech. Check it out!
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question