2008 sets incorrect security on systemroot on DCs in root domain
i'm having consistent problem attempts upgrade dcs of root domain server 2008. dcpromo setting incorrect acls way down windows folder on server 2008 try promote, and any existing 2003 dc upgraded 2008 ends same way.
for example on system32 get:
authenticated users read & execute this folder, subfolders , files
server operators modify this folder, subfolders , files
administrators full control this folder, subfolders , files
system full control this folder, subfolders , files
trustedinstaller special this folder only
creator owner special subfolders , files only
whereas should be:
trustedinstaller special this folder , subfolders
system special this folder only
system special subfolders , files only
administrators special this folder only
administrators special subfolders , files only
users read & execute this folder, subfolders , files
creator owner special subfolders , files only
which before dcpromo on clean installation.
most folders, not all, beneath inheriting, when shouldn't be.
this stopping services starting - annoyingly event viewer service doesn't have permission on winevt folder (server operators do). permissions cryptography service, diagnostic policy service, network service , whole list of others missing appropriate folders.
this has happened 32-bit , 64-bit upgrades of existing windows server 2003 r2 sp2 dcs , clean build of server 2008 dcpromoed. in case of clean build acls correct before dcpromo , wrong afterwards.
the root domain windows server 2003 native. there haven't been windows 2000s years.
forestprep , domainprep went without error. schema object version 44 (correct server 2008).
it not seem related fsmo role.
what i'm getting looks strange mix of server 2003 , server 2008 acls.
however, 2 child domains have had domain controllers upgraded without problem. acls correct. happening in root.
on 1 occasion tried obscenely long manual edit, resetting acls in comparison 1 of successful dcs in 1 of child domains. sadly reset old acls within few hours.
so, can tell me how happening? original default dc ace setting list used dcpromo kept? weird list of aces coming from? why can't rid of it? why in 1 domain?
which means used either microsoft's default security templates or high security templates domain controllers (both seems withdrawn) needs clear them out before windows server 2008 upgrade.
Windows Server > Directory Services
Comments
Post a Comment