Azure / Azure/avdaccelerator

NTFS FSLogix - Permissions are to broad

Open
#869 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Bicep
Stars
427
Forks
254
PR merge metrics
No merged PRs in 30d

Description

### What happened? Provide a clear and concise description of the bug, including deployment details.

Hello,

in the current version of "Script-DomainJoinStorage.ps1" the NTFS Permissions for EntraIDKerberos deployments are set incorrectly. Users can see and mount profiles of other users wich is a major security issue.

I think the `icacls ${DriveLetter}: /remove "Authenticated Users"` should not be conditioned on if the user uses EntraIDKerberos or not.

Thanks for looking into this.

### Please provide the correlation id associated with your error or bug.

-

### What was the expected outcome?

Expected Outcome is that trying to access another folder / file in another folder is denied.

### Relevant log output

```Shell
-
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.