OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: NTFS and ACLs
From: Gu1tarb0yAOL.COM
Date: Wed Sep 13 2000 - 11:05:00 CDT

To All

I am losing my mind...or bits of it here and there and would appreciate. I was trying to tighten down file ACLs on two workstations loaded with NT 4.0 SP6a.
Machine 1) I bring up properties=> security=> permissions. The screen and info is not the standard GUI to which I am "accustomed." The dialog box is very primitive, has large check boxes, etc ,and various inheritance "hooks" on some of the accounts listed. Say you want to remove a group... you may have to go to an advanced tab to remove the inheritance feature first. It also warns that you must add a legitimate group before removing the only existing one, because removing the only group will mean Everybody was denied access. The auditing tab is also only found after pressing the advanced radio button. What have I stumbled on to, and how do I get this workstation to display file properties with the standard NTFS properties dialog box?

Machine 2) I want to set some ACLS here also but when I press the permissions button, nothing happens. Same results when I select the auditing and ownership buttons. This machine's regedt32 also fails to execute, with a vague reference to missing .DLLs??? Regedit works fine, but the display features are so foreign, I am hesitant to use it as a registry editing tool. If I map a connection to this machine, I can display and set the file ACLs with no problem. If I bring up REGEDT32 on another machine and select machine 2, I can connect to two of the registry keys and make some registry modifications that way.
Can the original NTFS permissions GUI of Machine 1) be recovered?
Any suggestions on re-establishing the REGEDT32 utility on that Machine 2?

Thanks

Jim McFarlen

P.S. Thanks to Paul and Chris for some energetic explorations into security measures and the ways in which they may be circumvented. I made an "instance specific" remark re: my local UNIX admins that may have been interpreted as a generalization, and for that I apologize as it was NOT the intent of the comment.
PEACE