I liked Windows 2000's improvements over NT 4.0, but I really found one thing annoying about it: the Documents and Settings folder. I do a lot of command-line work, you see, and folder names with spaces are a pain in the neck. You've got to put quotes around them, and even if you do, some programs get a bit stupid when handed a folder name with spaces in it.
NT originally stored user profiles in winnt\profiles, but Microsoft decided to move the profiles out of the OS's directory (which probably made sense) into a separate location. That, again, was a good idea; calling it “Document and Settings”, in contrast, was a bad one. (Not as dumb as making people learn goofy phrases like HKEY_LOCAL_MACHINE to understand the Registry, but dumb enough.)
But we've been living with Documents and Settings for six and some years, so Microsoft knows that there will be some application out there that doesn't follow the rules, and decides to write some data to c:\documents and settings\ some-users-name \ some-folder-name instead of just asking the operating system where that user's profile folder is. To combat that, Microsoft creates a Documents and Settings folder on the drive, but hides it. Then they take things a step further and set its NTFS permissions to-you'll love this-deny the Everyone group read access to Documents and Settings. The result? Any application that tries to create data in Documents and Settings, rather than just asking the OS where to put the profile information, will fail.
Source of Information : Sybex Administering Windows Vista Security: The Big Surprises
No comments:
Post a Comment