Best Practices

• Learn to use icacls and subinacl.

• Become familiar with how OWNER RIGHTS works.

• Explore and understand the new default permissions.

• Learn SDDL if you do not already know it.

• Do not modify permissions on built-in objects except for in very targeted and narrow circumstances. KB article 885409 still applies. Changing the default permissions on a single file to offset a zero-day vulnerability is rarely an issue and can often be very useful. You can even do this with a startup script. Modifying the ACL on the root of the C: drive because you want to use Authenticated Users instead of Built-in Users is almost certainly going to destroy your system and will certainly leave you with an unsupported and unsupportable system. The more you understand about how permissions work, the less likely you are to get yourself into trouble and the less likely you are to use wholesale permissions changes in the first place.