Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000125

Folder on SYSVOL with non-default access permissions

Medium
Active Directory
Defense Evasion Persistence Privilege Escalation
v32

Signature Identity

CTD-000125
Threat ID
32
Version
IOC-IOE
Indicator Type

Threat Description

Improper access permissions for directory data files could allow unauthorized users including threat actors to read, modify, or delete directory data. The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.

NOTE: Cayosoft Guardian defines privileged users in Active Directory as users with adminCount=1. By design Active Directory uses this attribute to protect members of administrative groups.

According to security best practices it is not recommended re-using admin accounts, instead these accounts must be de-provisioned. If an account has administrative permissions, it might also obtain access to other resources using these administrative permissions and keep this access even after it is removed from the administrative groups. Learn more about AdminSdHolder and SDProp – Microsoft Community Hub.

MITRE ATT&CK: Attack Tactics

Defense Evasion Persistence Privilege Escalation

D3FEND: Defend Tactics

Application Configuration Hardening

Remediation

To review and remove non-default permissions on the SYSVOL folder:

  1. Open Windows Explorer on a domain controller.
  2. Navigate to \\localhost\SYSVOL.
  3. Right-click the directory and select Properties.
  4. Select the Security tab.
  5. Click Advanced.
  6. If there are any non-default permissions, review and remove them.
  7. Ensure the permissions on the SYSVOL directory do not allow for greater than read & execute permission for standard user accounts or groups.
  8. Ensure the default values below meet this requirement:

    9. Name – Authenticated users
    Permission – Read & execute
    Apply To – This folder, subfolder and files
    Name – Server operators
    Permission – Read & execute
    Apply To – This folder, subfolder and files
    Name – Administrators
    Permission – Special
    Apply To – This folder only
    (Permission – Special – Permissions: all selected except Full control, Delete subfolders and files)
    Name – CREATOR OWNER
    Permission – Special (Full control in Detail view)
    Apply To – Subfolders and files only
    Name – Administrators
    Permission – Special (Full control in Detail view)
    Apply To – Subfolders and files only
    Name – SYSTEM
    Permission – Full control
    Apply To – This folder, subfolders and files

Frequently Asked Questions

What does Folder on SYSVOL with non-default access permissions mean?

A SYSVOL folder has non-default access permissions when its NTFS permissions are set to allow access by users or groups other than the default ones. This can include setting explicit permissions, denying default permissions, or modifying group membership.

This issue allows unauthorized users to read or modify directory data, which can be used for malicious purposes. An attacker could use this access to gather sensitive information about the domain or disrupt its operations by modifying critical files.

An attacker can read or modify directory data, potentially gathering sensitive information about the domain. They may also be able to disrupt its operations by modifying critical files. This access can support later attacker activity, such as lateral movement or privilege escalation.

Cayosoft Guardian continuously monitors the access permissions of the SYSVOL directory and flags any folders with non-default permissions as security issues, alerting administrators to review and correct the settings.

Cayosoft Guardian helps reduce the risk by providing visibility into folder access permissions, allowing administrators to identify and correct issues before they can be exploited. This supports investigation and response efforts, helping teams respond quickly to security incidents.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Forest-wide Infrastructure
Attack Tactics
Defense Evasion Persistence Privilege Escalation
Defend Tactics
Application Configuration Hardening
Indicator Types
IOC IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical