Verify the permissions on the SYSVOL directory.
Open a command prompt.
Run "net share".
Make note of the directory location of the SYSVOL share.
By default this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level.
Open Windows Explorer.
Navigate to \Windows\SYSVOL (or the directory noted previously if different).
Right click the directory and select properties.
Select the Security tab.
Click Advanced.
If any standard user accounts or groups are allowed greater than read & execute permissions, this is a finding. The default permissions noted below meet this requirement.
Name - Authenticated Users
Permission - Read & execute
Apply To - This folder, subfolder and files
Name - Server Operators
Permission - Read & execute
Apply To - This folder, subfolder and files
Name - Administrators
Permission - Special
Apply To - This folder only
(Permission - Special : all selected except Full control, Delete subfolders and files)
Name - CREATOR OWNER
Permission - Special (Full control in Detail view)
Apply To - Subfolders and files only
Name - Administrators
Permission - Special (Full control in Detail view)
Apply To - Subfolders and files only
Name - SYSTEM
Permission - Full control
Apply To - This folder, subfolders and files
Alternately, use Icacls.exe to view the permissions of the SYSVOL directory.
Open a command prompt.
Run "icacls c:\Windows\SYSVOL
The following results should be displayed:
NT AUTHORITY\Authenticated Users:(RX)
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE)
BUILTIN\Server Operators:(RX)
BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE)
BUILTIN\Administrators:(M,WDAC,WO)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(F)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(M,WDAC,WO)
CREATOR OWNER:(OI)(CI)(IO)(F)
(RX) - Read & execute
Run "icacls /help" to view definitions of other permission codes.