Setting NTFS security via group policies

You can set NTFS security via group policies.

This has two majoor advantages. First, even if someone changes the settings localy, they are reset to the GPO settings whenever group policy is refreshed. Second, by using GPO you can set the NTFS permissions for multiple machines in one simple step.

Furthermore, by using the policy templates provided by Microsoft, you can also set extra security settings on system drives and the registry.

So how do you do it?

Open the MMC plug-in "Security Configuration and Analysis" or use the "users and computers" plug-in, selecting the GPO for a specifiec OU.

You should do this on a server which has the directories or partition you want to secure!

To add a specific NTFS setting go to:

Computer configuration, Security Settings, File System.

Right click "File System" and select "add file." Choose the path to the partitiondirectoryfile.

Next, select the users and permission you wan't to set.

Then choose how this policy should be set. You can choose to either:

A. Propagate inheritable permissions to all subfolders and files. This will change all current NTFS permissions.

B. Replace existing permissions on all subfolders and files with inheritable permissions. This will change permissions only on those files which inherit their permissions from the current folder.

C. Do not allow permissions on this file or folder to be replaced.


Requires Free Membership to View

and save the Group Policy. Once the machine policy is reapplied (every 15 minutes or so or after a reboot, the new settings will be set.

You can also manually apply the policy by typing the following command at the command prompt:

"secedit /refreshpolicy machine_policy"

This was first published in April 2001

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.