Best practice in securing SYSVOL custom directories without breaking the AD replication?

Question

People,

I need some confirmation whether the default SYSVOL folder content does not include Scripts directory?

This location: \myADDomain.com\SYSVOL\myADDomain.com\scripts

Because I can see this directory in one of my Domain Controllers is Full Control for all Authenticated Users.

Does changing this into Read & Execute to all Authenticated Users is recommended?

Thanks in advance.

Answer 1

Yes, the scripts are within the sysvol directory. It isn't recommended to modify permissions of sysvol or its contents.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hello @EnterpriseArchitect ,

Thank you for posting here.

Hope the information provided by DSPatrick is helpful to you.

Here is my suggestion for your reference.

Q: I need some confirmation whether the default SYSVOL folder content does not include Scripts directory?
This location: \myADDomain.com\SYSVOL\myADDomain.com\scripts
A: Yes, it includes.

Q: Does changing this into Read & Execute to all Authenticated Users is recommended?
A: We do not recommend any changes to the permissions of the SYSVOL folder, because any changes to the permissions of the SYSVOL folder may cause various SYSVOL replication problems or GPO application problems, and these problems are very difficult to repair/fix or possible unable to repair/fix.

Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 3

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

That's great explanation, many thanks @Anonymous and @Anonymous