Overview

Active Directory File Services documents the File Server configuration in an Active Directory environment.

---

1. File Server Configuration

File Server Shares

1.1 Shares

• Access Based Enumeration (ABE) - allows shares and folders to be visible only to groups that have permission to access (Read) them.
• Caching of Shares - allows shares to be cached locally for offline access by the user.
• Share Permissions are set only for the respective departments; restrictive control is administered through NTFS permissions.
• Default NTFS Permissions
  • Domain Admins: Full Control, SYSTEM: Full Control, CREATOR OWNER: Full Control

Name	Path	Share Permission	NTFS Permission
Engineering	C:\Shares\Departments\Engineering	Engineering: Change	Engineering: Modify IT-Support: Special IT-Support-Admins: Full Control
Finance	C:\Shares\Departments\Finance	Finance: Change	Finance: Modify IT-Support: Special IT-Support-Admins: Full Control
Legal	C:\Shares\Departments\Legal	Legal: Change	Legal: Modify IT-Support: Special IT-Support-Admins: Full Control
HR	C:\Shares\Departments\HR	HR: Change	HR: Modify IT-Support: Special IT-Support-Admins: Full Control
IT	C:\Shares\Departments\IT	IT: Change	IT: Modify IT-Support: Special IT-Support-Admins: Full Control
Executives	C:\Shares\Departments\Executives	Executives: Change	Executives: Modify IT-Support: Special IT-Support-Admins: Full Control

• IT-Support: Special - contains 8 advanced permissions: Traverse folder/execute file, List folder/Read data, Read attributes, Read extended attributes, Write attributes, Write extended attributes, Read permissions, Change permissions.
• Wallpapers$ - a hidden share used by IT-Support & IT-Support-Admins to deploy desktop wallpapers across Domain Computers.

---

1.2 FSRM

• File Screening - enabled

• Block: Audio Video & Image Files:

  • Screen Type: Active - actively blocks storing audio, video and image files. Media File Screening

• Warn: Executables & System Files:

  • Screen Type : Passive - logs access or execution attempts involving executable and system files, recording the user, file location, and event details. Executable & System File Screening