Azure / Azure/ArcEnabledServersGroupPolicy

Logging Path does not need to allow full Write & Modify permissions for all domain computers

Open
#29 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
17
Forks
25
PR merge metrics
No merged PRs in 30d

Description

The current permissions set up on the Logging Path are slightly over permissive. At the moment all Domain Computers (which includes client devices) can modify or delete the log files created by other servers. It is possible to use the CREATOR OWNER permission (similar to the supported method for [Folder Redirection](https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/create-security-enhanced-redirected-folder)) so that it is not possible for log files to be modified by another computer after a server has created it.

Pull request incoming!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.