Automic Windows Agent - setting folder permissions using SDDL language
Article ID: 448798
Updated On:
Products
Issue/Introduction
In the v24.4.5/v26.1.0 Windows Agent a new feature was introduced that enable the user to customize the file permissions of operational folders (security, resources, temp, and backup).
Thanks to this improvement the permission can be managed more precisely comparable to the Unix Agents.
The leads to increase security when needed such that files can be read and modified only by the user or group who submits the job.
This is accomplished by using SDDL language: https://www.splunk.com/en_us/blog/security/windows-security-sddl-guide-access-control.html
Environment
Windows Agent v24.4.5 and higher
Windows Agent v26.1.0 and higher
Resolution
The section [MISC] is introduced in the ini-file of the Windows Agent which contains the FolderPermissions* parameters (analogue to the Unix Agent).
The parameters can be used to set the file permissions much in the way as for the Unix Agent using the SDDL language.
The default is explained in the new ini-file:
[MISC]
;
; FolderPermissions:
; The specification is used as the default file access permissions for newly created Agent's directories.
; The permissions can be specified using the Windows Security descriptor definition language (SDDL)
; If this parameter is not explicitly specified (left blank), following SDDL string will be used: D:P(A;OICIIO;GA;;;CO)(A;OICI;GA;;;BA)(A;;0x1200a9;;;AU)(A;OICIIO;0x1200a9;;;AU)
; D:P - DACL with no inheritance
; (A;OICIIO;GA;;;CO) - Full Control to Creator Owner
; (A;OICI;GA;;;BA) - Full Control to Build-in Administrators
; (A;;0x1200a9;;;AU)(A;OICIIO;0x1200a9;;;AU) - R+X Control to Authenticated Users
;
FolderPermissions=D:P(A;OICIIO;GA;;;CO)(A;OICI;GA;;;BA)(A;;0x1200a9;;;AU)(A;OICIIO;0x1200a9;;;AU)
;
; FolderPermissions_backup: Permission string of backup directory, can be used to overwrite the default settings
;
FolderPermissions_backup=
;
; FolderPermissions_temp: Permission string of Agent's temp directory, can be used to overwrite the default settings
;
FolderPermissions_temp=
;
; FolderPermissions_jobreport: Permission string of Agent's job report directory, can be used to overwrite the default settings
;
FolderPermissions_jobreport=
;
; FolderPermissions_cache: Permission string of Agent's resources cache directory, can be used to overwrite the default settings
;
FolderPermissions_cache=
IMPORTANT: the default is only set on newly created folders.
So, to take any changes into account, users should delete their temp and out etc. folders and let the Agent recreate them on startup with the intended permissions.
If you want to adjust and set the permission manually in the Windows GUI, you can do so as required and then use the following Powershell command to extract the SDDL description:
Powershell:
(Get-Acl .).Sddl
The output is subsequently copied to the Agent's ini-file. (To be sure you can delete the folder again and let the Agent recreate it with the correct permissions).
NOTE: If you are upgrading an existing Agent you have to copy the new [MISC]-section into the existing ini-file.
Additional Information
The feature was introduced through DE184933:
Public description
An issue has been fixed where the Windows Agent did not set proper permissions for its operational folders (security, resources, temp, and backup).
To resolve this, a new FolderPermissions INI parameter has been introduced, allowing administrators to define custom security settings using SDDL language. Additionally, a new secure default is now applied, granting owners full permissions to their objects while restricting other users to read-only access.
Feedback
