default NTFS permissions on system partition : everyone group in or out

[johndoe]

When setting up a new server, is the Everyone group going to have full
control to the C: drive (system partition) by default?

This is a big problem when people who are not part of the domain can connect
to C$ (if they know what they're doing).

Can anyone think of a single good reason why Everyone should be allowed full
access to the C: drive?

(When we took the Everyone group out on the Exchange2k server, we ran into
instant problems - users called to say that they had lost their connection
to the server.)

Thanks in advance.

 

[Ray at]

That is not true. NTFS permissions may be set to give everyone full
control, but the default SHARE permissions for C$ are NOT set like this.

Ray at work

 

[Steven L Umbach]

They may have full permission to ONLY the root/drive folder and will not be able to
connect to the administrative share unless it is set up with a blank administrator
password. This has been changed in XP pro and Windows 2003 which should be used as a
model on how to configure permissions for the root folder where at the very least you
will want to configure the everyone group to have no more than
ad/list/execute. --- Steve

 

[Roger Abell]

Also, concerning you experience on Ex when removing
the grant to Everyone, remember on the old OS versions,
when you removed Everyone you do need to provide the
part of Everyone that is desired by use of such as Users.