Adding a computer account to file's security list

  • Thread starter Thread starter Rich Evans
  • Start date Start date
R

Rich Evans

In the Active Directory you can add not only users and groups to a
file or folder Security list, but also computer accounts. What results
from granting Change permission on a folder to a computer account?
Does this mean that _anyone_ logged into that machine has Change
permission? Or does it mean any local account on that machine has
Change permission?
 
Rich Evans said:
In the Active Directory you can add not only users and groups to a
file or folder Security list, but also computer accounts. What results
from granting Change permission on a folder to a computer account?
Does this mean that _anyone_ logged into that machine has Change
permission? Or does it mean any local account on that machine has
Change permission?
Click to expand...


Computer accounts represents one of the internal system accounts. It is also
referred as SYSTEM or "Local System" account.
Most of local system services run under this account. It has more rights on
the computer than even Administrator account.

So as with any other account, granting some permissions to particular
account allow processes running under this account to perform some action
with object on which permissions are applied.

As an example imagine startup script that sterts some executable or writes
to some log on network share. For this script to run correctly you need to
grant write permission on share to domain computers' accounts since startup
scripts run under LocalSystem account.

Al.
 
Rich Evans said:
In the Active Directory you can add not only users and groups to a
file or folder Security list, but also computer accounts. What results
from granting Change permission on a folder to a computer account?
Click to expand...

It's going to sound redundant but it would allow the computers account
(presumably you mean it's account in the domain) to Change that
resource.
Does this mean that _anyone_ logged into that machine has Change
permission?
Click to expand...

Not at all - it give NO ONE except the computer additional access.
Or does it mean any local account on that machine has
Change permission?
Click to expand...

Yes.

This is seldom dones since most resource access is by "user accounts"
but as of Win2000, computer accounts were made "first class security
objects" (full security principles).

This "first class" behavior means that you can place the computer
account into groups and grant or deny it permissions or rights on
the network/domain resources.

Under NT, you could use the "system" account but this was a purely
local account and could not be granted access on network resources
as a domain account can (now) be granted.

Mostly this feature is used for two main purposes:

1) Filtering GPO objects so that they only apply to a subset of
the computer accounts in a domain or OU.

2) Allowing accessing to files on the network for so that
Group Policy "software assignments" to the computer can be
fetched from the network shares by the computer account even
before any user is logged on.

Of course, you can use this feature for any granting or denying of
permissions or rights that make sense for a "computer" ITSELF,
but the above two are the obvious new situation for which the
feature was primarily enabled in Win2000+.
 
Back
Top