Detections
Analytics
WN25-00-000140 - Windows Server 2025 permissions for the system drive root directory (usually C:\) must conform to minimum requirements.
Information
Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.The default permissions are adequate when the Security Option 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled' (WN25-SO-000240).
Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124
Solution
Maintain the default permissions for the system drive's root directory and configure the Security Option 'Network access: Let Everyone permissions apply to anonymous users' to 'Disabled' (WN25-SO-000240).Default Permissions
C:\
Type - 'Allow' for all
Inherited from - 'None' for all
Principal - Access - Applies to
SYSTEM - Full control - This folder, subfolders, and files
Administrators - Full control - This folder, subfolders, and files
Users - Read & execute - This folder, subfolders, and files
Users - Create folders/append data - This folder and subfolders
Users - Create files/write data - Subfolders only
CREATOR OWNER - Full Control - Subfolders and files only
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R1_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r1
Category: ACCESS CONTROL
References: 800-53|AC-3(4), CAT|II, CCI|CCI-002165, Rule-ID|SV-277998r1180700_rule, STIG-ID|WN25-00-000140, Vuln-ID|V-277998
Plugin: Windows
Control ID: 674515852b424abca0a4bea895c43e98d644cf203d7b03af37097ebddd5a7c7a