Share via


File system security settings for Virtual Server

File system security settings

The ability to view and specify configuration settings for Virtual Server 2005, virtual machines, virtual networks, and virtual hard disks is controlled by discretionary access control lists (DACLs) on the Virtual Server folders and files.

This topic describes the DACLs that are configured by default for these folders and files. These DACLs give members of the Administrators group on the computer running the Virtual Server service full control over Virtual Server, virtual machines, virtual networks, and locally stored virtual disks.

For more information about configuring these settings to allow users to access and control Virtual Server and its components, see Configuring Virtual Server security settings, Configuring virtual machine security, and Configuring virtual disk security.

Click a heading to show or hide the contents.

DACL for the Virtual Server folder

Virtual Server Setup creates the Virtual Server folder, which is located by default in C:\Documents and Settings\All Users\Application Data\Microsoft\. The Virtual Server folder contains the following items:

  • Virtual Server configuration file (Options.xml)
  • Virtual Server license file (VSLicense.xml)
  • Virtual Machines folder, which contains shortcuts to the configuration files of virtual machines that are currently configured on Virtual Server
  • Virtual Networks folder, which contains shortcuts to the configuration files of virtual networks that are currently configured on Virtual Server

The DACL on this folder applies to the folders and files that it contains. The following table lists the default access control entries (ACEs) of this DACL. Although you can configure this DACL from within the file system, we recommend that you instead use the Virtual Server Security Settings page of the Administration Website. For instructions, see Configure Virtual Server Security Settings.

The default DACL for the Virtual Server folder is shown in the following table.

User account Permissions (allow) Apply to

Administrators

Full Control

This folder, subfolders, and files

CREATOR OWNER

Full Control

Subfolders and files only

SYSTEM

Read & Execute

This folder, subfolders, and files

SYSTEM

Create Files/Write Data

Create Folders/Append Data

This folder only

NETWORK SERVICE

Read & Execute

This folder, subfolders, and files

NETWORK SERVICE

Create Files/Write Data

Create Folders/Append Data

This folder only

DACL for the Virtual Server configuration file

The following table describes the default DACL for the Virtual Server configuration file (Options.xml), located by default in C:\Documents and Settings\All Users\Application Data\Microsoft\Virtual Server. You can change the DACL on this file; however, we recommend that instead you configure global security settings for Virtual Server by using the Administration Website. For instructions, see Configure Virtual Server Security Settings.

User account Permissions (allow) Apply to

Administrators

Full Control

This object only

NETWORK SERVICE

Full Control

This object only

SYSTEM

Read & Execute

This object only

DACL for the Virtual Server license file

The following table describes the default DACL for the Virtual Server license file (VSLicense.xml), located by default in C:\Documents and Settings\All Users\Application Data\Microsoft\Virtual Server.

User account Permissions (allow) Apply to

Administrators

Full Control

This object only

NETWORK SERVICE

Read & Execute

This object only

SYSTEM

Read & Execute

This object only

DACL for the Virtual Machine Helper folder

The following table describes the default DACL for the Virtual Machine Helper folder, located by default in C:\Documents and Settings\All Users\Application Data\Microsoft. This folder contains the NETWORK SERVICE file, described next.

Warning

You should not change the DACL on this folder. If you do, virtual machines that you have configured to run under a specific user account may not be able to turn on, and encrypted password information contained in this file could become accessible to unauthorized users.

User account Permissions (allow) Apply to

Administrators

Full Control

This folder, subfolders, and files

CREATOR OWNER

Full Control

Subfolders and files only

SYSTEM

Read & Execute

This folder, subfolders, and files

SYSTEM

Create Files/Write Data

Create Folders/Append Data

This folder only

NETWORK SERVICE

Read & Execute

This folder, subfolders, and files

NETWORK SERVICE

Create Files/Write Data

Create Folders/Append Data

This folder only

DACL for the NETWORK SERVICE file

The following table describes the default DACL for the NETWORK SERVICE file, located by default in C:\Documents and Settings\All Users\Application Data\Microsoft\Virtual Machine Helper. This file stores encrypted information about the user accounts under which virtual machines have been configured to run. For more information about configuring this account, see Modifying general virtual machine properties.

Warning

You should not change the DACL on this file. If you do, virtual machines that you have configured to run under a specific user account may not be able to turn on, and encrypted password information contained in this file could become accessible to unauthorized users.

User account Permissions (allow) Apply to

NETWORK SERVICE

Full Control

This object only

DACL for the Virtual Server Webapp folder

The following table describes the default DACL for the Virtual Server Webapp folder, located by default in C:\Documents and Settings\All Users\Application Data\Microsoft\. This folder contains the ServerPaths.xml file, described next.

User account Permissions (allow) Apply to

SYSTEM

Full Control

This folder, subfolders, and files

Administrators

Full Control

This folder, subfolders, and files

Users

Read & Execute

This folder, subfolders, and files

Power Users

Traverse Folder/Execute File

List Folder/Read Data

Read Attributes

Read Extended Attributes

Create Files/Write Data

Create Folders/Append Data

Write Attributes

Write Extended Attributes

Delete Subfolders and Files

Delete

Read Permissions

This folder, subfolders, and files

Everyone

Read & Execute

This folder, subfolders, and files

DACL for the Virtual Server Manager search paths file

The following table describes the default DACL for the Virtual Server Manager search paths file (ServerPaths.xml), located by default in C:\Documents and Settings\All Users\Application Data\Microsoft\Virtual Server WebApp. This file stores information about the search paths that have been configured for Virtual Server Manager. For more information, see Configuring Virtual Server Manager search paths.

User account Permissions (allow) Apply to

SYSTEM

Full Control

This folder, subfolders, and files

Administrators

Full Control

This folder, subfolders, and files

Users

Read & Execute

This folder, subfolders, and files

Power Users

Traverse Folder/Execute File

List Folder/Read Data

Read Attributes

Read Extended Attributes

Create Files/Write Data

Create Folders/Append Data

Write Attributes

Write Extended Attributes

Delete Subfolders and Files

Delete

Read Permissions

This folder, subfolders, and files

Everyone

Read & Execute

This folder, subfolders, and files

DACL for the Shared Virtual Machines folder

The following table describes the default DACL on the Shared Virtual Machines folder, located by default in C:\Documents and Settings\All Users\Shared Documents.

User account Permissions (allow) Apply to

Administrators

Full Control

This folder, subfolders, and files

CREATOR OWNER

Full Control

Subfolders and files only

SYSTEM

Read & Execute

This folder, subfolders, and files

SYSTEM

Create Files/Write Data

Create Folders/Append Data

This folder only

NETWORK SERVICE

Read & Execute

This folder, subfolders, and files

NETWORK SERVICE

Create Files/Write Data

Create Folders/Append Data

This folder only

DACLs for virtual machine folders and files

The following tables describe the default DACLs on the folders and files that are created by Virtual Server when you create and manage a virtual machine. Virtual machine configuration folders and files are located by default in C:\Documents and Settings\All Users\Shared Documents\Shared Virtual Machines.

DACL for a virtual machine configuration folder

User account Permissions (allow) Apply to

Administrators

Full Control

This folder, subfolders, and files

CREATOR OWNER

Full Control

Subfolders and files only

SYSTEM

Read & Execute

This folder, subfolders, and files

NETWORK SERVICE

Read & Execute

This folder, subfolders, and files

DACL for virtual machine configuration (.vmc) files

User account Permissions (allow) Apply to

Administrators

Full Control

This object only

SYSTEM

Read & Execute

This object only

NETWORK SERVICE

Read & Execute

This object only

DACL for virtual machine saved-state (.vsv) files

User account Permissions (allow) Apply to

Administrators

Full Control

This object only

SYSTEM

Read & Execute

This object only

NETWORK SERVICE

Read & Execute

This object only

User account under which the virtual machine is running when its state is saved

Full Control

This object only

DACL for the Shared Virtual Networks folder

The following table describes the default DACL on the Shared Virtual Networks folder, located by default in C:\Documents and Settings\All Users\Shared Documents.

User account Permissions (allow) Apply to

Administrators

Full Control

This folder, subfolders, and files

CREATOR OWNER

Full Control

Subfolders and files only

SYSTEM

Read & Execute

This folder, subfolders, and files

SYSTEM

Create Files/Write Data

Create Folders/Append Data

This folder only

NETWORK SERVICE

Read & Execute

This folder, subfolders, and files

NETWORK SERVICE

Create Files/Write Data

Create Folders/Append Data

This folder only

DACL for a virtual network configuration (.vnc) file

The following table describes the default DACL on the configuration file that is created by Virtual Server when you create a virtual network. Virtual network configuration (.vnc) files are located by default in C:\Documents and Settings\All Users\Shared Documents\Shared Virtual Networks.

User account Permissions (allow) Apply to

Administrators

Full Control

This object only

SYSTEM

Read & Execute

This object only

NETWORK SERVICE

Full Control

This object only

DACLs for virtual hard disk (.vhd) files and virtual floppy disk (.vfd) files

The following table describes the default DACL on the file that is created by Virtual Server when you create a virtual hard disk or virtual floppy disk. Virtual hard disk (.vhd) files that are created at the same time a virtual machine is created are located by default in the virtual machine configuration folder, in C:\Documents and Settings\All Users\Shared Documents\Shared Virtual Machines. Other virtual hard disk files and all virtual floppy disk (.vfd) files are stored in the location that was specified when the file was created.

User account Permissions (allow) Apply to

Administrators

Full Control

This object only

SYSTEM

Read & Execute

This object only

NETWORK SERVICE

Read & Execute

This object only