NT Gatekeeper: Resetting Default Access-Control Settings

What's the easiest way to reset all the NTFS access-control settings to the default settings on a Windows NT Server 4.0 system?

The Microsoft article "Default NTFS Permissions in Windows NT" (http://support.microsoft.com/?kbid=148437) defines the default NTFS access-control settings for an NT Server machine. To apply the default settings to an NT Server machine, you can create a batch file that calls on the Cacls or the Xcacls command-line utilities. You can also create a custom Security Configuration Manager (SCM) security template and apply the template to the server.

Unlike Windows 2000's SCM version, the NT Server SCM version doesn't include templates that define the default NTFS settings. In Win2K, these files are called defltsv.inf (for servers) and defltws.inf (for workstations). In NT Server, SCM provides the most straightforward and flexible solution for resetting the NTFS defaults. NT Server doesn't install SCM by default; it comes as an add-on tool in NT Server Service Pack 4 (SP4).

I used the NTFS default settings to create an NT Server security configuration file, defntfssv4.inf, that's based on the information in the Microsoft article. You can download defntfssv4.inf from the Security Administrator Code Library at http://www.secadministrator.com/articles/index.cfm?action=code. Your organization might have other basic NTFS needs, so you can customize the defntfssv4.inf file by using the following steps:

  1. Copy the file to the \%systemroot%\security\templates directory.
  2. Log on as an administrator and start Microsoft Management Console (MMC) by typing
  3. mmc

    at the command line.

  4. Select Add/Remove Snap-in from the Console menu. In the resulting dialog box, click Add, select the Security Configuration Manager snap-in, and click OK twice.
  5. Expand Security Configuration Manager, Configurations, and the templates containers, then locate the container for the defntfssv4.inf security configuration file.
  6. Expand the defntfssv4.inf container and right-click the File System folder. Select Add Files or Add Folder, depending on the NTFS settings you want to add.
  7. Save the template by right-clicking the template container and selecting Save.

To reset the default security settings on an NT Server machine, follow these steps:

  1. Expand Security Configuration Manager and right-click Database. Select the Import Configuration option.
  2. Select the defntfssv4.inf security configuration file or the modified security configuration file you created in the previous steps, then click Open.
  3. To reset the NTFS settings based on the settings in the security configuration file, right-click Database again and select Configure System Now.
Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish