Windows Files Folders And Tools (Page 2 of 5) in pdf

Imaging files (for scanners)

twain_32

ht)

Logon Rights

Printer and wallpaper files

Prohibits a user from logging on to the

Web

Deny logon through

computer using a Remote Desktop

Terminal Services

Side by Side (shared components)

WinSxS

File Name

Descriptions

connection. Default setting: Not assigned.

(SeDenyRemoteInteracti

veLogonRight)

Allows a user to connect to the computer from

Access this computer

System32 Folder and Subfolders

the network. Default setting: Administrators,

from the network

Power Users, Users, Everyone, and Backup

(SeNetworkLogonRight)

Privileges

File Name

Descriptions

Operators.

File Name

Descriptions

Essential system files (for example, Hal.dll and

Allows a user to log on to the computer by

system32

Allow logon through

Ntoskrnl.exe files)

using a Remote Desktop connection. Default

Terminal Services

Allows a process to assume the identity of

Act as part of the

setting: Administrators and Remote Desktop

(SeRemoteInteractiveLog

Localization (language) files for a specific language,

1025, 1028, 1031,

any user and thus gain access to the resources

operating system

Users.

onRight)

corresponding to the number assigned to this folder.

1033, 1037, 1041,

that the user is authorized to access.

(SeTcbPrivilege)

This folder remains empty unless Windows XP

Allows a user to log on by using a batch-

1053, 2052, 3076

Log on as a batch job

Typically, only low-level authentication

Professional is localized for this particular language.

queue facility such as the Task Scheduler

(SeBatchLogonRight)

services require this privilege. Default setting:

service. Default setting: Administrator,

Not assigned.Note that potential access is not

Catalog files and signature files

CatRoot

System, and Support_xxxxxxxx. When an

limited to what is associated with the user by

Catalog files and signature files

CatRoot2

administrator uses the Add Scheduled Task

default; the calling process might request that

wizard to schedule a task to run under a

arbitrary additional privileges be added to the

Com

Component Object Model (COM) objects

particular user name and password, that user

access token. The calling process might also

Registry files and event logs

Config

is automatically assigned the "Log on as a

build an access token that does not provide a

batch job" right. When the scheduled time

DHCP database files

primary identity for tracking events in the

Dhcp

arrives, the Task Scheduler service logs the

audit log.When a service requires this

DirectX files

DirectX

user on as a batch job rather than as an

privilege, configure the service to log on

interactive user, and the task runs in the user's

Windows File Protection backup files

Dllcache

using the Local System account, which has

security context. The Support_xxxxxxxx

the privilege inherently. Do not create a

Installed drivers

Drivers

account is the logon account for Remote

separate account and assign the privilege to it.

Encryption Pack installation files

Export

Assistance.

Allows the user to add a computer to a

Add workstations to

Internet Authentication Service files

Ias

Allows a user to start an interactive session on

Log on locally

specific domain. For the privilege to take

domain

the computer. Default settin g: Administrators,

(SeInteractiveLogonRigh

effect, it must be assigned to the user as part

(SeMachineAccountPrivil

Universal Plug and Play files

Icsxml

Power Users, Users, Guest, and Backup

of the Default Domain Controllers Policy for

ege)

Ime

Language files

Operators. Users who do not have this right

the domain. A user who has this privilege can

can start a remote interactive session on the

Internet Information Services files

add up to 10 workstations to the domain.

Inetsrv

computer if they have the "Allow logon

Default setting: Not assigned.Users can also

Macromedia files

Macromed

through Terminal Services" right.

join a computer to a domain if they have

Cryptography files

Microsoft

Create Computer Objects permission for an

Allows a security principal to log on as a

Log on as a service

organizational unit or for the Computers

service. Services can be configured to run

Microsoft Distributed Transaction Coordinator files

(SeServiceLogonRight)

MsDtc

container in Active Directory. Users who

under the Local System, Local Service, or

Multi-user interface files

Mui

have this permission can add an unlimited

Network Service accounts, which have a

number of computers to the domain

Network Monitor and trace files

Npp

built-in right to log on as a service. Any

regardless of whether they have been

service that runs under a separate user account

Windows Welcome files

Oobe

assigned the "Add workstations to a domain"

must be assigned the right. Default setting:

privilege.

Remote access server encryption files

Ras

Network Service.

Allows a process that has access to a second

Adjust memory quotas

Data files or System Restore related files

Restore

Prohibits a user from connecting to the

Deny access to this

process to increase the processor quota

for a process

computer from the network. Default setting:

computer from the

RPC Proxy files (RPCProxy.dll)

Rpcproxy

assigned to the second process. This privilege

(SeIncreaseQuotaPrivileg

The Support_xxxxxxxx account used by

network

Optional component manager files

is useful for system tuning, but it can be

Setup

Remote Assistance is denied this right.

(SeDenyNetworkLogonRi

abused. In the wrong hands, it could be used

ght)

Shell extension components

ShellExt

to launch a denial-of-service attack. Default

Prohibits a user from logging on directly at

SMS Site Component Manager files

Deny logon locally

Smsmsgs

setting: Administrators, Local Service, and

(SeDenyInteractiveLogon

the keyboard. Default setting: Guest.

Network Service.

Print spooling files

Spool

Right)

Allows the user to circumvent file and

Back up files and

User State Migration tool

Usmt

Prohibits a user from logging on by using a

Deny logon as a batch job

directory permissions to back up the system.

directories

Web-based Enterprise Management data files.

batch-queue facility. Default setting: Not

Wbem

(SeDenyBatchLogonRigh

The privilege is selected only when an

(SeBackupPrivilege)

Windows Management Instrumentation (WMI) is the

assigned.

application attempts access by using the

Microsoft implementation of WBEM.

NTFS backup application programming

Prohibits a user from logging on as a service.

Deny logon as a service

interface (API). Otherwise, normal file and

WINS database files

Wins

Default setting: Not assigned.

(SeDenyServiceLogonRig

Windows Files Folders And Tools Page 2

Related Articles

Related forms

Related Categories