Default Security & Permissions

Hi,

Is there a list somewhere that details what the permissions should be for the various directories within Windows XP. I have looked at Q244600 (Microsoft knowledge base recommended by a Windows XP book), but the settings there don't tie up exactly with what I have on another virgin machine.

When an administrator installs an application, can the installation process modify existing security permissions? If so is this logged anywhere?

I have three machines and I am finding that they all seem to be different in terms of file permissions.

Would a repair installation revert these settings as they should be?

Why do some users appear in SID form (S-1-5-21-....) rather that the more intuitive user name, when checking permissions on some directories? Is there a simple procedure to force these to their proper names? This happens when an account has been deleted and a new account has been created with the same user name.

Regards FarmerJo

 

This happens because the OS works strictly from the SID even though it displays the username associated with it to make things easier for us normal mortals. When you delete an account and add it back, the account looks the same to you (same name) but as far as the OS is concerned, it's a totally new/different account and not related to the original in any way.

Any time you see just a SID listed in the security permissions section, you might as well remove it since it is worthless.

 

Hi,

If I attempt to removde it I get an error to the affect that it cannot be removed because it is, itself inheriting permissions from elsewhere. OK, I can cut the inheritance and remove it that way, but this then creates another potential problem.

Because some directories were created with the previous account (that is now deleted) those permissions are no longer present where they should be for the new account (with the same name), if you see what I mean!

Would I be right in saying that the new account permissions must be manually added where the old account permissions were (and are marked by this SID thingy)?

You may be wondering why I did this rather odd thing, this is the reason. Originally I had an account that I wanted to change the name of and password for. This was a simple job as you know. I then checked the "Documents and Settings" directory and expected to see the new account name there also (replacing the old name), but it wasn't. In fact the OS continued to use the same old directory name for the renamed account.

So then I created a new account (having renamed the initial account to avoid conflicts), with the required name and this did show up in the "Documents and Settings" directory. I copied all settings and data to the new account and then deleted the old account and this did as I wanted.

Perhaps there was a simpler way to do this? I'm guessing that simply renaming the folder manually would be a bad idea.

Regards FarmerJo

 

Would I be right in saying that the new account permissions must be manually added where the old account permissions were (and are marked by this SID thingy)?

Perhaps there was a simpler way to do this? I'm guessing that simply renaming the folder manually would be a bad idea.

From what I can think of right now, I think your only safe option is to manually fix everything and to avoid the renaming. But there are a couple of things here that I haven't messed with in yonks and am a little hazy on.

If someone else know for sure and answers, great. Otherwise I'll do some experimenting tomorrow afternoon and give a solid answer.