Hi what permission should be granted and for which user / group on the w2k8 (stand alone, or domain member server) server e.g. %systemdrive%, %windir% etc.Is there any tool to automate such settings?Regards

Hi, It was suggested not edit default permissions on system folders. Windows system has give proper permission to users/groups on system folders. Default permission for build-in users/groups are well designed. When you create a new user/group, it will get proper permission settings according to it user type/user group. So, please dont edit permission settings for system folders. If you need to delegate administrator right to specific group/user, please refer to the following Best Practices. Best Practices for Delegating Active Directory Administration http://www.microsoft.com/downloads/details.aspx?familyid=631747a3-79e1-48fa-9730-dae7c0a1d6d3&displaylang=en Thanks

http://www.microsoft.com/downloads/details.aspx?familyid=631747a3-79e1-48fa-9730-dae7c0a1d6d3&displaylang=en.aspxinternal and external linking gets to me too ...ShemsInformation is the most valuable commodity I know off.

Hi,There is something wrong with the link. Please try the following links. Best Practices for Delegating Active Directory Administration http://download.microsoft.com/download/7/b/6/7b674ccf-cf69-4b2b-b8f7-3164cec5d5e5/Active_Directory_Delegation.doc Thanks

I was thinking about your question 'is there a tool?' when I saw this page:http://technet.microsoft.com/en-us/sysinternals/25e27bed-b251-4af4-b30a-c2a2a93a80d9.aspx'to automate such settings' refers to security templates.The tool (only) detects settings; it wouldn't be wise, in my view, to combine the two in one tool with regards to security.Sysinternals is fun; especially their screensaver.Shems. Information is the most valuable commodity I know off.