File share ACLs have not been reconfigured to remove the Everyone group.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3245	2.015	SV-25006r1_rule	ECAN-1	Medium

Description
By default, the Everyone group is given full control to new file shares. When a share is created, permissions should be reconfigured to give the minimum access to those accounts that require it.

STIG	Date
Windows 7 Security Technical Implementation Guide	2014-01-07

Details

Check Text ( C-26689r1_chk )
Open the Computer Management Console. Expand the “System Tools” object in the Tree window. Expand the “Shared Folders” object. Select the “Shares” object. Right click any user-created shares (ignore administrative shares; the system will prompt you if Properties are selected for administrative shares). Select Properties. Select the Share Permissions tab. If user-created file shares have not been reconfigured to remove ACL permissions from the “Everyone” group, then this is a finding. Documentable: Yes Documentable Explanation: If shares created by applications require the “Everyone” group, this should be documented with the IAO.

Check Text ( C-26689r1_chk )

Open the Computer Management Console.
Expand the “System Tools” object in the Tree window.
Expand the “Shared Folders” object.
Select the “Shares” object.
Right click any user-created shares (ignore administrative shares; the system will prompt you if Properties are selected for administrative shares).
Select Properties.
Select the Share Permissions tab.

If user-created file shares have not been reconfigured to remove ACL permissions from the “Everyone” group, then this is a finding.

Documentable: Yes
Documentable Explanation: If shares created by applications require the “Everyone” group, this should be documented with the IAO.

Fix Text (F-59r1_fix)
Remove permissions from the Everyone group from locally-created file shares and assign them to authorized groups.