20.51 Ensure 'Permissions for the Windows installation directory conform to minimum requirements'

Information

This policy setting ensures permissions for the Windows installation directory conform to minimum requirements.

The recommended STIG state for this setting is: TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only Users - Read & execute - This folder, subfolders, and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files and ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files

Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.

Solution

Maintain the default permissions for the Windows installation directory and configure

2.3.10.5 Ensure 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled'

(WN19-SO-000240).

- View the Properties of the Windows installation directory
- Select the

Security

tab
- Select the

Advanced

button

Change the permissions to match the default.

Default permissions:

\Windows

Type - 'Allow' for all

Inherited from - 'None' for all

Principal - Access - Applies to

TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only Users - Read & execute - This folder, subfolders, and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files and ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files

Impact:

Non-privileged groups such as Users or Authenticated Users must not have greater than 'Read & execute' permissions except where noted as defaults. Individual accounts must not be used to assign permissions.

See Also

https://workbench.cisecurity.org/benchmarks/15032