Permissions

t4echo

I am getting ready to take this exam again as I failed the previous time. I have a question about when they ask you to give certain access to users and groups, etc. If they already have some populated that look incorrect should I delete them or just give the access that is asked? Having worked in the real world with this I find myself tempted to delete when I'm not sure if I should.

An example would be if the everyone group has full permissions locally on the client.

mrhaun03

Are you referring to share permissions or NTFS permissions?

Any book that I've seen, their best practice is to give Full Control to Everyone for the Share permissions and restrict access with the NTFS permissions. NTFS also block/allow local access as well as network access to resources.

Tontonsam

If you are uncertain to access to give some users, you should not delete them cause if you recreate the same user, it won't be effectively the same cause they are different SID. Another way to have this kind of problem is to give permissions to users and not for group. If you respect this principe AGDLP (Put Account into Global group and to Domain Local to give permissions), you won t have this kind of problem.
Everyone doesn't have full permissions, if it was like that anyone could take ownership on other files or change permissions. Everyone has full permissions on its own files.

RobertKaucher

If there is a question telling you to assign permissions to resources DO NOTHING NOT ASKED FOR IN THE QUESTION? If they do not tell you you should do anything with users previously assigned permissions do not touch the old users.

t4echo

Thanks for all the input. I think I will stick to the DO NOTHING NOT ASKED FOR IN THE QUESTION tip. I believe I may have hurt my score in the past by changing something that I felt would be incorrect in a real world scenario.