Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications (SUA) is a source-compatibility subsystem for compiling and running custom UNIX-based applications on a computer running a Microsoft® Windows® server-class operating system. You can make your UNIX applications fully interoperable with Windows in SUA with little or no change to your original source code.

Subsystem for UNIX-based Applications provides an operating system for Portable Operating System Interface (POSIX) processes. SUA, along with its package of support utilities (such as shells and a Telnet client) available for download on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139521), provides a complete UNIX environment. The download package includes a comprehensive set of scripting utilities, and a software development kit (SDK) designed to fully support the development capabilities of SUA and to provide a complete UNIX-based application development experience.

SUA also supports case-sensitive file names, job control, compilation tools, and the use of over 300 UNIX commands, utilities, and shell scripts. Because the subsystem installs separately from the Windows kernel, it offers true UNIX functionality without any emulation.

Features in this release

Features in Subsystem for UNIX-based Applications include the following:

  • Database (OCI/ODBC) library connectivity SUA supports connectivity to Oracle and SQL Server from database applications by using the Oracle Call Interface (OCI) and the Open Database Connectivity (ODBC) standard.

  • Microsoft Visual Studio® Debugger Extension for debugging POSIX applications SUA includes support for debugging your POSIX processes by using the Visual Studio integrated development environment (IDE).

  • Utilities based on SVR-5 and BSD UNIX environments The SUA download package supports two different UNIX environments: SVR-5 and BSD.

  • Support for 64-bit applications By using a process called thunking, SUA provides support not only for 64-bit applications running on a 64-bit operating system, but also default support for 32-bit binaries running on a 64-bit operating system.

For more information, and to download the scripting utilities and the SDK, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139521).

In this section

Subsystem for UNIX-based Applications Overview

Installing Utilities and SDK for Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications and Case Sensitivity

Setuid in Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications and POSIX Compliance

Supported System Calls

Anonymous Users and Traverse Checking

See Also

  • Utilities and SDK for Subsystem for UNIX-based Applications in Microsoft Windows Vista RTM, Windows Vista SP1, and Windows Server 2008 RTM


Subsystem for UNIX-based Applications Overview

Subsystem for UNIX-based Applications (SUA), the evolution of the Interix subsystem that formerly shipped with Windows Services for UNIX 3.5, is a multi-user UNIX environment that operates on computers running Windows server-class operating systems. SUA and its accompanying utilities provide you with an environment that resembles UNIX-based operating systems. It also includes case-sensitive file names, job control, compilation tools, and the use of over 300 UNIX commands, utilities, and shell scripts. Because SUA is designed to run atop the Windows kernel, it offers true UNIX-based functionality without any emulation.

In this section

Installing Subsystem for UNIX-based Applications

Computing environments with Subsystem for UNIX-based Applications

Porting applications by using Subsystem for UNIX-based Applications

Installing Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications (SUA) is a feature included with Microsoft® Windows Server® 2008 R2 and Windows® 7.

Important

Until the download package Utilities and Software Development Kit for Subsystem for UNIX-based Applications (Utilities and SDK for SUA) has been installed on the computer, you cannot run or modify UNIX-based scripts and custom UNIX-based applications. The Utilities and SDK for SUA package is available for download on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139521).

How to install Subsystem for UNIX-based Applications on Windows 7

How to install Subsystem for UNIX-based Applications on Windows Server 2008 R2

How to install Subsystem for UNIX-based Applications on Windows 7

You can install Subsystem for UNIX-based Applications either by using the Windows 7 interface, or by using a command prompt. Perform the following steps to install SUA on your computer.

Using the Windows interface

Using a command line

Using the Windows interface

To install SUA by using the Windows interface

  1. Click Start, and then click Control Panel.

  2. In the Control Panel window, click Programs.

  3. Under Programs and Features, click Turn Windows features on or off.

  4. If the User Account Control dialog box opens, click Continue. Otherwise, proceed to the next step.

  5. In the Windows Features dialog box, select the Subsystem for UNIX-based Applications check box. Click OK.

  6. In the Add Features Wizard, on the Select Features page, select the Subsystem for UNIX-based Applications check box.

    Installation might require a few minutes to complete.

Using a command line

To install SUA by using a command line

  1. Open a command prompt window. To open a command prompt window, click Start, click in the Start Search text box, type cmd and then press ENTER.

    A Command Prompt shortcut may also be available on the Start menu.

  2. Change directories to %windir%\system32.

    Example: The current directory is C:\Documents and Settings\user_name.

    Type cd ..\..\Windows to change to the C:\Windows directory.

  3. Enter the following command:

    start /w pkgmgr /iu:SUA

  4. If a User Account Control dialog box opens , click Continue.

    Installation is complete when the command window displays a %windir%\system32 prompt on a new line.

How to install Subsystem for UNIX-based Applications on Windows Server 2008 R2

You can install Subsystem for UNIX-based Applications either by using the Windows Server 2008 R2 interface, or by using a command prompt. Perform the following steps to install SUA on your computer.

Using the Windows interface

Using a command line

Using the Windows interface

To install SUA by using the Windows interface

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the Features Summary area of the Server Manager home page, click Add Features.

    The Add Features Wizard opens.

  3. On the Select Features page of the Add Features Wizard, select Subsystem for UNIX-based Applications, and then click Next.

  4. Click Install.

    Installation might require a few minutes to complete.

Using a command line

As with other features available with Windows Server 2008 R2, you can use the Server Manager command line to install or remove SUA from your computer. The Server Manager command line has other parameters available that you can use to show you more information about the installation process or to identify features already installed on the computer. For more information about the Server Manager command line, see the Server Manager Help.

To install SUA by using a command line

  1. Open a Command Prompt window with elevated privileges. To do this, right-click the Command Prompt executable, or the Command Prompt object on the Start menu, and then click Run as administrator.

  2. Type the following, and press ENTER.

    ServerManagerCmd.exe -install Subsystem-UNIX-Apps -restart

    Note

    The command identifier for SUA, Subsystem-UNIX-Apps, is not case sensitive.

    The -restart parameter at the end of the Server Manager command instructs Server Manager to restart the computer only if necessary to complete the installation process.

    You can also use the Server Manager line command with an XML answer file. For more information about using answer files with the Server Manager command, see "Creating an Answer File for Server Manager Commands" in the Server Manager Help.

Computing environments with Subsystem for UNIX-based Applications

A computer running SUA provides two different command-line environments: the UNIX environment and the Windows environment. Applications run on specific subsystems and in specific environments. When you load SUA, you are using a UNIX environment; when you run applications on the Windows subsystem, you are using a Windows environment.

For example, when you use the Korn shell or C shell available with the download package Utilities and SDK for SUA, or any other application that was compiled to run on SUA, you are using a UNIX environment. Among other things, this environment features case-sensitive file names and path names that use the format /usr/examples. For more information about the commands and utilities that are available in SUA, see the Help files that ship with the download package Utilities and SDK for SUA. This download package is available from the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139521).

When you use the command processor cmd.exe, you are using the Windows environment. This environment includes case-insensitive file names, and path names that include drive letters, as shown in the following example: C:\SUA\usr\examples. For more information about path names in SUA and Windows, see the Help files that ship with the download package Utilities and SDK for SUA.

Porting applications by using Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications provides both the tools and the application programming interface (API) libraries for porting applications to run on Windows-based computers. With the software development kit (SDK), which provides a front end for the Microsoft Visual C++® development system, you can have a UNIX environment for development, but still have the benefits of the native compiler for Windows. For more information about path names in SUA and Windows, see the Help files that ship with the download package Utilities and SDK for SUA.

See Also

  • Utilities and SDK for Subsystem for UNIX-based Applications in Microsoft Windows Vista RTM, Windows Vista SP1, and Windows Server 2008 RTM


Installing Utilities and SDK for Subsystem for UNIX-based Applications

The download package Utilities and Software Development Kit (SDK) for Subsystem for UNIX-based Applications, available from the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139521), is designed to work with the Subsystem for UNIX-based Applications (SUA) component that ships with Microsoft® Windows Server® 2008 R2.

Components included with download package

The download package contains the following components:

  • Base utilities

  • SVR-5 utilities

  • Base SDK

  • GNU SDK

  • GNU utilities

  • UNIX Perl

  • Visual Studio Debugger Extension

In addition to the features provided in Windows® Services for UNIX 3.5, the download package supports 64-bit application development with SUA. The download also enables development and porting of custom UNIX applications by using the Windows Oracle Call Interface (OCI) and Windows ODBC libraries (collectively referred to as "mixed mode" throughout this document).

Base utilities, GNU utilities, SDK, and UNIX Perl

These components include all utilities that formerly installed with Windows Services for UNIX 3.5. This consists of the nearly 300 BSD-based and optional SUA GNU utilities. Many of these utilities (approximately 80) are also available in 64-bit versions.

GNU components include utilities and SDK tools distributed under the terms of the GNU General Public License (GPL).

For a complete listing of base utilities, see the Help and release notes provided with the installation package.

SVR-5 utilities

This set consists of a Korn shell and approximately 150 utilities, most of which support SVR-5. These utilities currently are available in 32-bit versions, and may fail in specific 64-bit scenarios; however, the utilities run on WOW 64-bit platforms.

For a complete listing of SVR-5 utilities, see the Help and release notes provided with the installation package.

Base SDK

The current release supports most of the libraries and headers installed with Windows Services for UNIX 3.5. These support both 32-bit and 64-bit SUA-related software migration and development.

This SDK consists of the following libraries and corresponding header files: Standard C Library, Standard C++ Library, and Math Library. The Standard C++ Library and the Math Library are functional equivalents of those supplied by Microsoft as part of their Microsoft Visual Studio® development system environment. The Standard C Library and the Math Library are available for both 32-bit and 64-bit platforms. The Standard C++ Library is available for both 32-bit and 64-bit binaries, and supports multithreaded applications.

Compiler compatibility

The Base SDK package can be used with either the gcc (GNU C) and g++ (GNU C++) compilers or the Visual Studio 2005 compiler. Linking to shared objects is not supported with the Visual Studio 2005 compiler. The Standard C++ Library supplied with this package is compatible with the Visual Studio 2005 compiler and can be used with c89.

The g++ compiler uses its own library for C++ compilation.

System requirements

The Utilities and SDK for Subsystem for UNIX-based Applications package installs only on Windows server-class operating systems.

The minimum system requirements for installing Utilities and SDK for SUA depend on which components you are installing and the file system of the disk where the components will be installed.

The maximum disk space required to install all Utilities and SDK for SUA components is approximately 350 MB.

Additional requirements

  • To receive product support, you must install the latest Windows service pack before installing Utilities and SDK for SUA, and then continue to install additional Windows service packs as they become available.

  • You must install Utilities and SDK for SUA on a partition that is formatted with the NTFS file system. File system operations on FAT partitions are not supported.

  • We recommend that the computer have at least 16 MB of RAM in addition to the recommended minimum configuration for the operating system.

Installation options

You can choose one of the following installation options when installing Utilities and SDK for Subsystem for UNIX-based Applications:

  • Standard installation

  • Custom installation

The following table shows which components are installed on a computer as part of the standard installation (Standard) and which additional components are available as part of a customized installation (Custom). If you select the customized installation, you can choose not to install components that are automatically installed as part of the standard installation. These components can only be installed on Windows server-class operating systems.

Component | Type of Installation
Base utilities | Standard
Base SDK | Standard
SVR-5 utilities | Custom
GNU utilities | Custom
GNU SDK | Custom
UNIX Perl | Custom
Visual Studio Debugger Extension | Custom
Note

If you are upgrading from Windows Services for UNIX 3.5, existing settings are saved during installation on computers running Windows Server 2008 R2 or Windows Server 2008, and are restored during the setup process for Utilities and SDK for SUA.

Installing Utilities and SDK for Subsystem for UNIX-based Applications by using the Windows interface

The following installation options are available:

  • Standard installation

  • Custom installation

Standard installation

To perform a standard installation

  1. Download the Utilities and SDK for Subsystem for UNIX-based Applications from the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139521).

  2. In the Utilities and SDK for Subsystem for UNIX-based Applications Wizard, click Next.

  3. In the User name box, type your name. If the name of your organization does not show in the Organization field, enter the name of your organization.

  4. Read the Microsoft Software License Terms carefully. If you accept the terms of the agreement, click I accept the terms in the License Agreement, and then click Next to continue installation. If you click I do not accept the License Agreement (Exit Setup), the installation procedure terminates.

  5. To install default Utilities and SDK for Subsystem for UNIX-based Applications components in the default directory, click Standard Installation, and then click Next. To customize your installation, see Custom installation.

Custom installation

To perform a custom installation

  1. Download the Utilities and SDK for Subsystem for UNIX-based Applications from the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139521).

  2. In the Utilities and SDK for Subsystem for UNIX-based Applications Wizard, click Next.

  3. In the User name box, type your name. If the name of your organization does not show in the Organization field, enter the name of your organization.

  4. Read the Microsoft Software License Terms carefully. If you accept the terms of the agreement, click I accept the terms in the License Agreement, and then click Next to continue installation. If you click I do not accept the License Agreement (Exit Setup), the installation procedure terminates.

  5. To install default Utilities and SDK for Subsystem for UNIX-based Applications components in the default directory, click Standard Installation, and then click Next (see Standard Installation in the preceding section). If you want to specify a different set of components or a different installation location, click Custom Installation, and then click Next.

  6. Select the check boxes for each component that you want to install, and then click the appropriate option. If you do not want to install a component, click the icon next to the component, and then click Entire feature will not be available. When you finish specifying the components to install, click Next.

  7. If you are installing the GNU Software Development Kit (SDK), read the information about the GNU Library General Public License carefully. If you want to install the GNU SDK, click Next to continue installation. To make changes to the components that you have selected, click Back.
Notes
  • After you have installed Utilities and SDK for Subsystem for UNIX-based Applications, you can install additional components or remove installed components.
  • Utilities and SDK for Subsystem for UNIX-based Applications components cannot be run from a network server. All files must be installed on the local computer.
  • Standard installation does not provide a complete UNIX development environment. To obtain all of the GNU compilers, build tools, and other SDK components, you must select Custom Installation and then select GNU SDK.
  • After Utilities and SDK for Subsystem for UNIX-based Applications is installed, setuid behavior is disabled by default. This affects the behavior of certain SUA programs.
  • In this installation, case sensitivity will not be enabled for object names (such as file names) in non-Win32 subsystems.

Installing Utilities and SDK for Subsystem for UNIX-based Applications by using the command line

Perform the following step to start a command-line installation of the Utilities and SDK for Subsystem for UNIX-based Applications.

To perform a command-line installation

  • At a command prompt, enter the following:

    msiexec /i [path\]setup.msi [ADDLOCAL="component[,component...]"] {/qb|/q}

The following table describes the arguments and options for this command.

Argument/Option | Description
path | The fully qualified path of the Utilities and SDK for SUA setup.msi file. If you omit the path, the setup.msi file must be in the current directory.
/qb | Installs Utilities and SDK for SUA with a basic user interface. You must specify either the /q or /qb option; otherwise, the results will be unpredictable.
/q | Installs Utilities and SDK for SUA with no user interface or display. This option allows you to perform an unattended installation. You must specify either the /q or /qb option; otherwise, the results will be unpredictable.
Notes
  • This command completes only a standard installation.
  • For security purposes, all SUA services (also called daemons) are disabled by default. To manage SUA services, edit the /etc/inetd.conf file.

See Also

  • Utilities and SDK for Subsystem for UNIX-based Applications in Microsoft Windows Vista RTM, Windows Vista SP1, and Windows Server 2008 RTM


Subsystem for UNIX-based Applications and Case Sensitivity

In Microsoft® Windows®-based operating systems, the names of most objects (such as files and directories) are case-preserving, but case-insensitive. That means you can use uppercase and lowercase characters when naming such objects, but Windows does not distinguish between names based on case alone. For example, you cannot have two files in the same directory named sample.txt and Sample.txt because Windows regards the names to be identical for the purposes of identifying files.

Case sensitivity and Subsystem for UNIX-based Applications

UNIX-based operating systems, by contrast, are fully case-sensitive, and so computers running UNIX-based operating systems distinguish between object names when the only difference between those names is the case of characters used in the object names. Therefore, on most UNIX-based computers, sample.txt and Sample.txt could be stored in the same directory, and the UNIX operating system would distinguish between them when performing operations on the files. For example, the command rm S*.txt would delete Sample.txt, but not sample.txt.

In order to implement typical UNIX behavior, Subsystem for UNIX-based Applications is normally case-sensitive when working with file names. This can present security issues, particularly for Windows users who are accustomed to the case-insensitive conventions of Windows. For example, a version of edit.exe infected with a Trojan horse-type malicious program, and named EDIT.EXE, could be stored in the same directory as edit.exe. If a user were to type edit at a Windows command prompt, the Trojan horse version (EDIT.EXE) could be executed instead of the standard version. If case sensitivity is enabled, Windows users should be made aware of this possibility.

Restoring case sensitivity defaults

In Microsoft Windows Server® 2008 R2, Windows® 7, Windows Server® 2008, Windows Vista®, Windows Server® 2003, and Windows XP operating systems, the default behavior of subsystems other than the Win32 subsystem is to be case-preserving but case-insensitive; in previous versions of Windows, such subsystems were fully case-sensitive by default. To support standard UNIX behavior, you can change the default Windows Server 2003 and Windows XP behavior for non-Win32 subsystems when installing the base utilities that are part of the download package Utilities and Software Development Kit (SDK) for Subsystem for UNIX-based Applications. If you enable case sensitivity and then subsequently uninstall the base utilities, setup restores the default, case-insensitive behavior of non-Win32 subsystems.

For more information about changing case sensitivity settings, see Configuring Case Sensitivity for File and Folder Names (http://go.microsoft.com/fwlink/?LinkId=53334).


Setuid in Subsystem for UNIX-based Applications

On many systems, a root user or superuser has complete control of the system. Subsystem for UNIX-based Applications (SUA) does not recognize a root user. When the Portable Operating System Interface (POSIX) standard was developed, the concept of a root user was considered an administrative issue. Instead of a root user, the POSIX standard defines appropriate privileges for some operations.

In this topic

setuid and setgid

Subsystem for UNIX-based Applications and identities

Setup considerations for setuid in Subsystem for UNIX-based Applications

setuid and setgid

The setuid and setgid mechanisms allow a program, when run, to adopt certain aspects of a security principal other than that of the user running the program. They allow the program to alternate these aspects between those of the invoking user and those of another security principal.

Appropriate privileges are distinct from this. While the setuid and setgid mechanisms allow an application to control the answer to the question: "Who are you?", appropriate privileges answer the question: "What can you do?"

Subsystem for UNIX-based Applications and identities

In typical UNIX environments, there is exactly one user to whom all privileges are granted. That user, typically called root, has uid == 0. In Subsystem for UNIX-based Applications, all supported privileges on a given system are granted to users who are members of either the Administrators group or the Domain Administrators group on that system. You do not need to log on as administrator. Any user with membership in either the Administrators group or the Domain Administrators group possesses root privileges. Not all privileges defined in POSIX or UNIX are available in SUA; that is, there are certain privileges that are not granted to any user.

Appropriate privileges are typically required for a variety of actions. These include accessing the file system, sending signals to other processes (process control), or changing the effective user identifier (UID) or group identifier (GID) for a process in order to change the ability of that process to perform certain actions.

According to the POSIX standard, a file has permissions that include bits to set a UID (setuid) and set a GID (setgid). If either or both bits are set on a file, and a process runs that file, the process gains the UID or GID of the file. When used carefully, this mechanism allows a nonprivileged user to run programs that run with the higher privileges of the file's owner or group. When used incorrectly, however, this can present security risks by allowing nonprivileged users to perform actions that should only be performed by an administrator. For this reason, SUA does not support this mechanism by default. Instead, if you attempt to run a file with either the setuid or setgid bit set, SUA does not run the file and returns the error code ENOSETUID.

Setup considerations for setuid in Subsystem for UNIX-based Applications

If you rely on an application that requires standard POSIX behavior, you can configure SUA to run files with the setuid or setgid bits set. If SUA is configured in this way, when a process runs a file that has the setuid or setgid bit set, SUA constructs local security tokens for the process with the privileges assigned to the owner or group of the file. Because the tokens are local, they are not recognized by other computers on the network. This means that, even if the file is owned by a member of the Domain Administrators group, for example, the process does not have trusted access through Microsoft® Windows® networking to other computers in the domain. Instead, the privileges will be effective only on the computer on which the process is running.

For example, a process runs a program file with its setuid bit set and owned by a member of the Domain Administrators group. If that program attempts to change a domain user's password, that attempt will fail because the security tokens of the process are local and so are not recognized by other systems in the domain. If, on the other hand, the program attempts to change a local user's password, the attempt will succeed because the file's owner is a member of the Domain Administrators group, which typically belongs to the local computer's Administrators group. For information about how to configure SUA to run files with the setuid or setgid bits set, see the Help files that ship with the download package Utilities and Software Development Kit (SDK) for UNIX-based Applications.

For the setuid(2), setgid(2), and chroot(2) functions, a process must have the effective UID that maps back to the system account, the administrator account for the local domain, or the administrator account for the principal domain. The local administrator account can only change the UID or GID to another ID in the same domain.

For chown(1), chmod(1), and chgrp(1), an account must have the Windows privileges SE_BACKUP and SE_RESTORE to perform make operations on files owned by another user or group, or to modify permissions on a file owned by another user. These permissions typically belong to the administrator and backup operator accounts.

See Also

  • Least Privilege, User Account Control, and Setuid


Least Privilege, User Account Control, and Setuid

Windows® 7 provides a simple mechanism for running end-user accounts with standard user privileges, while eliminating the need for administrator privileges when performing common tasks, such as installing a printer driver or connecting to a wireless network. This fundamental shift helps to provide security at the operating system level by preventing malicious software (also called malware) and root kits from damaging company-wide files and settings.

User Account Control (UAC) is based upon the security theory of least privilege, the concept that users should have the absolute minimum privilege required to perform assigned tasks. Changes in Subsystem for UNIX-based Applications that are compatible with UAC include use of the Least-privilege User Account (LUA).

User Account Control

User Account Control is a security feature in Windows 7 that was introduced with Windows Vista.

The primary goal of User Account Control is to reduce the exposure and attack surface of the Windows 7 operating system by requiring that all users run in standard user mode, and by limiting administrator-level access to authorized processes. This limitation minimizes the ability for users to make changes that could destabilize their computers or inadvertently expose the network to viruses through undetected malicious software that has infected their computer.

By default, Windows 7 runs every application as a standard user even if the current user is logged on as a member of the Administrators group. Conversely, when users attempt to launch an application that has been marked as requiring administrator permissions, Windows 7 prompts them to confirm their intention to do so. Only applications running with administrator privileges can modify system and global settings and behavior.

For more information about User Account Control, see the Microsoft Web site topic "Understanding and Configuring User Account Control in Windows Vista" (http://go.microsoft.com/fwlink/?LinkId=70242).

User Account Control and least privilege in Subsystem for UNIX-based Applications

When a Subsystem for UNIX-based Applications user who is a member of the Administrators group launches an application, shell, or other task, the applications run in the security context of the standard user.

The following example demonstrates how User Account Control can prevent users who are members of the Administrators group from performing administrative tasks without elevated privilege.

User A is a member of the Administrators group, and wants to create a new directory called test in the / (root) directory. Creating new directories in the root directory is allowed only by members of the Administrators group. However, although User A is a member of the Administrators group, User A cannot create the new directory because of LUA restrictions. User A opens a Korn shell with elevated privileges and is allowed to create the test directory in root.

To run an application or perform tasks with elevated privileges, see the following procedures.

How to run an application as an administrator

With Subsystem for UNIX-based Applications and its download package of tools and utilities installed, there are two ways to run an application as an administrator.

Using the Windows interface

Using a UNIX-based command line

Using the Windows interface

To run an application in the Windows user interface that requires administrative privileges, perform the following steps.

To run an application as the administrator in the Windows interface

  1. Right-click the application executable file.

  2. On the shortcut menu, click Run as administrator.

Using a UNIX-based command line

To run an application in the UNIX-based Korn shell environment that requires administrative privileges, perform the following steps.

To run an application as the administrator in a Korn shell

  1. Click Start, click All Programs, click Subsystem for UNIX-based Applications, and then point to Korn shell.

  2. Right-click Korn shell, and then click Run as administrator.

  3. When you are prompted to allow the shell to run as administrator, click Yes.

  4. Run the program that requires Administrator privileges.

  5. When you have finished running the application that requires elevated privilege, close the shell session.

    To perform other tasks in the UNIX-based shell environment that do not require Administrator privileges, open a new shell session without using the Run as administrator command.

EnableSuToRoot registry key

User Account Control is enabled by default. When User Account Control is enabled, any application or task that impersonates another user who is a member of the Administrators group (by using the su, cron, or login utilities, setuid, any of the setuid or exec_asuser family of calls, as examples) always runs in the security context of a standard user account.

Note

When an application impersonates a standard user, it will have the complete security context of a standard user. For more information about standard users, see the Microsoft Web site topic "Developer Best Practices and Guidelines for Applications in a Least Privileged Environment," Introduction section (http://go.microsoft.com/fwlink/?LinkId=70243).

With default settings, an application cannot impersonate the root user. You can control this behavior by modifying the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUA\EnableSuToRoot.

How to modify the EnableSuToRoot registry key

Important

The Administrator account is disabled by default in Windows 7 and Windows Server 2008 R2 to help protect computers and data from access by unauthorized or malicious users, and it must be enabled for users to impersonate the root user or Administrator. Because the Administrator account must first be enabled to change the setting of the EnableSuToRoot registry key, the procedure to complete this task immediately follows. You must be a member of the Administrators group on the local computer to complete the following procedure.

To enable the Administrator account

  1. Click Start, right-click Computer, and then click Manage.

  2. In the hierarchy pane of the Computer Management snap-in, open Local Users and Groups.

  3. Select Users.

  4. In the results pane, right-click Administrator, and then click Properties.

  5. Clear the check box for the Account is disabled option.

  6. Click OK.

  7. Close the Properties window, and then close the Computer Management snap-in.

Perform the following steps to change the setting of the EnableSuToRoot registry key after you install Subsystem for UNIX-based Applications.

To change the setting of the EnableSuToRoot registry key

  1. Click Start, click in the Start Search text box, and type regedit to open Registry Editor.

  2. In the hierarchy pane, open HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUA.

  3. In the results pane, double-click EnableSuToRoot.

  4. In the Value data box, enter 0 to disallow impersonation of the root user, or 1 to allow it.

    The default setting is 0.

  5. Click OK.

  6. Close Registry Editor; if prompted, save your changes.

When the value of this key is set to 0 (the default setting), impersonation of the root user is disallowed. When the value is set to 1, impersonation of the root user is allowed. When an application impersonates the root user or Administrator account, the application has the administrative security context of the root (Administrator) user.

Setuid and Administrative Privilege

If users who are members of the Administrators group attempt to mark applications with the setuid attribute, they would succeed only if they are allowed to run applications and perform tasks in an administrative security context.

The following is an example of how to mark the binary file /bin/regpwd, which is typically marked with the setuid attribute:

  1. Open a Korn shell (ksh) with elevated privilege as described in this topic.

  2. Type chmod +s /bin/regpwd and then press ENTER.

  3. Type exit to close the ksh session.

See Also

  • Setuid in Subsystem for UNIX-based Applications


Subsystem for UNIX-based Applications and POSIX Compliance

Subsystem for UNIX-based Applications (SUA) provides a Portable Operating System Interface-compliant (POSIX-compliant) subsystem that runs UNIX shells, utilities, and applications natively alongside Microsoft® Windows® applications. This topic describes some of the working considerations for users who require a POSIX-compliant operating system.

POSIX shell compatibility

The SUA Korn shell follows traditional Korn shell behavior, which is almost identical to POSIX behavior. If you need strict POSIX conformance, which some work environments require, see the differences between the Korn shell and POSIX in the ksh(1) documentation in the Help files found in the download package Utilities and Software Development Kit (SDK) for Subsystem for UNIX-based Applications.

To get full POSIX.2 conformance from the Korn shell, you must run the Korn shell in POSIX mode. To run the Korn shell in POSIX mode, do one of the following:

  • Open the Korn shell with the -o posix option.

  • Run the command set -o posix from within the shell.

  • Set the POSIXLY_CORRECT shell parameter.

POSIX conformance is not supported in the C shell. Unlike the Korn shell, the C shell has no POSIX-mode command options.

Traverse checking of directory permissions

By default, Windows users have permissions to move through a directory tree, though they might not have permissions to access each directory in the path. On POSIX systems, you cannot access a directory unless you have permission to access every directory in the path to the directory. This POSIX behavior is known as traverse checking. For example, if you do not have permission to access a directory, you cannot change the current directory to any of its subdirectories, even if you have permission to access the subdirectories. By default in Windows, you can change the current directory to any subdirectories for which you have permission.

In Windows, there is a special permission called the Traverse Folder/Execute File permission, which you can set for a user or group. You can configure this permission to allow or deny movement through a directory tree. The Traverse Folder permission takes effect only when the group or user is not granted the Bypass Traverse Checking user right in the Group Policy snap-in. In Microsoft Windows 2000, by default, the Everyone group is given the Bypass Traverse Checking user right. In the Windows Server® 2008 R2, Windows® 7, Windows Server® 2008, Windows Vista®, Windows Server 2003, and Windows XP operating systems, the Administrators, Backup Operators, Everyone, Power Users, and Users groups all have this right. For strict conformance with POSIX standards, remove the Bypass Traverse Checking user right from all users and groups except the Backup Operators group. To conform to privileges granted to the root user on many other UNIX implementations, remove the Bypass Traverse Checking user right from all users except the Administrators and Backup Operators groups.

Deviation of traverse checking behavior for su and setuid

Root users that are using the su command to run as other users, and users that are using setuid processes (and those processes that include setuid-related calls), deviate from the default behavior described above by retaining some directory traverse rights.

Removing the Bypass traverse checking right from user accounts results in POSIX-compliant behavior. However, when a root user attempts to run su on any other user without providing a password, the resulting session does not have the behavior described above. Processes started after a root user runs su without providing a password can access and move through a directory tree, although they might not have permissions to access every directory in the path.

Setuid processes, and processes that call setuid, seteuid, or setreuid, also exhibit the same behavior. After removing the Bypass traverse checking right from the account of the user running these processes, the processes are able to progress through a directory tree, though they might lack permissions to access each directory in the path.

See Also

  • Subsystem for UNIX-based Applications


Supported System Calls

The syscall(2) function performs the system call whose assembly language interface has the specified number with the specified arguments. Symbolic constants for system calls can be found in the header file <sys/syscall.h>.

For more information about the syscall function, see the Help and release notes provided with the Utilities and Software Development Kit (SDK) for Subsystem for UNIX-based Applications installation package, available for download from the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139521).

Supported system calls

The following system calls are supported by Subsystem for UNIX-based Applications.

_control87 | _controlfp | _exit
_getInstallPath | _getInstallPath_Win | _prefixInstallPath
_prefixInstallPath_Win | _tolower | _toupper
Aa64l | abort | abs
accept | access | acos
acosh | alarm | alloca
alphasort | arc4random_addrandom | arc4random
arc4random_stir | asctime | asctime_r
asin | asinh | assert
atan | atan2 | atan2f
atanf | atanh | atexit
atof | atoi | atol
auth_destroy | authenticateuser | authnone_create
authunix_create | authunix_create_default | Bbasename
bcmp | bcopy | bind
bindresvport | blf_cbc_decrypt | blf_cbc_encrypt
blf_dec | blf_ecb_decrypt | blf_ecb_encrypt
blf_enc | blf_key | brk
bsearch | bzero | Ccabs
calloc | callrpc | catclose
catgets | catopen | cbrt
ceil | cfgetispeed | cfgetospeed
cfsetispeed | cfsetospeed | chdir
chmod | chown | chpass
chroot | clearerr | clnt_control
clnt_create | clnt_destroy | clnt_freeres
clnt_geterr | clnt_pcreateerror | clnt_perrno
clnt_perror | clnt_spcreateerror | clnt_sperrno
clnt_sperror | clnt_statclnt_broadcast | clnt_statclnt_call
clnt_statpmap_rmtcall | clntraw_create | clnttcp_create
clntudp_bufcreate | clntudp_create | clock
close | closedir | closelog
confstr | connect | copysign
copysignf | cos | cosh
creat | crypt | ctermid
ctime | ctime_r | cuserid
Ddaemon | dbm_clearerr | dbm_close
dbm_delete | dbm_error | dbm_fetch
dbm_firstkey | dbm_nextkey | dbm_open
dbm_store | des_cipher | des_setkey
difftime | dirfd | dirname
div | dlclose | dlerror
dlopen | dlsym | dn_comp
dn_expand | drand48 | drem
dup | dup2 | Eecvt
el_deletestr | el_end | el_getc
el_gets | el_init | el_insertstr
el_line | el_parse | el_push
el_reset | el_resize | el_set
el_source | encrypt | endgrent
endhostent | endnetent | endprotoent
endpwent | endservent | endutxent
env | env_alloc | env_array
env_cron | env_expand_win | env_free
env_get | env_login | env_put
env_putarray | env_set | env_strfree
env_t | env_unset | env_winlogin
erand48 | erf | erfc
err | errno | errx
exec | exec_asuser | execl
execl_asuser | execle | execle_asuser
execlp | execlp_asuser | execv
execv_asuser | execve | execve_asuser
execvp | execvp_asuser | exit
exp | expm1 | Ffabs
fabsf | fchdir | fchmod
fchown | fclose | fcntl
fcvt | fdopen | feof
ferror | fflush | ffs
fgetc | fgetln | fgetpos
fgets | fgetwc | fgetws
fileno | finite | finitef
flock | flockfile | floor
floorf | fmod | fnmatch
fopen | fork | forkpty
fp_nquery | fp_resstat | fpathconf
fprintf | fpurge | fputc
fputs | fputwc | fputws
fread | free | freeaddrinfo
freopen | frexp | fscanf
fseek | fsetpos | fstat
fstatvfs | fsync | ftell
ftime | ftok | ftruncate
ftrylockfile | fts_children | fts_close
fts_open | fts_read | fts_set
ftw | funlockfile | fwrite
Ggai_strerror | gamma | gamma_r
gcvt | get_myaddress | getaddrinfo
getbsize | getc | getcwd
getdate | getdtablesize | getegid
getenv | geteuid | getgid
getgrent | getgrent_nomembers | getgrgid
getgrgid_r | getgrgid_ex | getgrgid_nomembers
getgrnam | getgrnam_r | getgrnam_nomembers
getgroups | gethostbyaddr | gethostbyname
gethostent | gethostname | getitimer
getlogin | getlogin_r | getmode
getnameinfo | getnetbyaddr | getnetbyname
getnetent | getopt | getpass
getpdomain | getpeername | getpgrp
getpid | getppid | getpriority
getprotobyname | getprotobynumber | getprotoent
getpwent | getpwnam | getpwnam_r
getpwuid | getpwuid_ex | getpwuid_r
getrlimit | getrpcbyname | getrpcbynumber
getrpcent | getrpcport | getrusage
gets | getsecret | getservbyname
getservbyport | getservent | getsockname
getsockopt | getsubopt | gettimeofday
gettzenv | getuid | getutxent
getutxid | getutxline | getwc
getw | getwchar | glob
globfree | gmtime | gmtime_r
grantpt | group_from_gid | Hhcreate
hcreate_r | hdestroy | hdestroy_r
herror | hesiod | hesiod_end
hesiod_free_list | hesiod_init | hesiod_resolve
hesiod_to_bind | history | history_end
history_init | hostalias | hsearch
hsearch_r | hstrerror | hstrerror
htonl | htons | hypot
Iiconv | iconv_close | iconv_open
ieee | ieee_test | ilogb
index | inet_addr | inet_aton
inet_cidr_ntop | inet_cidr_pton | inet_lnaof
inet_makeaddr | inet_netof | inet_network
inet_ntoa | infnan | initstate
ioctl | iruserok | isalnum
isalpha | isascii | isatty
isblank | iscntrl | isdigit
isgraph | isinf | isinff
islower | isnan | isnanf
isprint | ispunct | isspace
isupper | isxdigit | iswalnum
iswalpha | iswblank | iswcntrl
iswctype | iswdigit | iswgraph
iswlower | iswprint | iswpunct
iswspace | iswupper | iswxdigit
Jj0 | j1 | jn
jrand48 | Kkill | killpg
Ll64a | labs | lchown
lcong48 | ldexp | ldiv
lfind | lgamma | lgamma_r
libm | link | listen
localeconv | localtime | localtime_r
lockf | log | log10
log1p | logb | longjmp
lrand48 | lsearch | lseek
lstat | Mmadvise | major
malloc | math | mblen
mbsntowcs | mbstowcs | mbtowc
mctl | MD4Data | MD4End
MD4File | MD4Final | MD4Init
MD4Transform | MD4Update | MD5Data
MD5End | MD5File | MD5Final
MD5Init | MD5Transform | MD5Update
memccpy | memchr | memcmp
memcntl | memcpy | memmove
memset | minor | mkdev
mkdir | mkfifo | mknod
mktemp | mktime | mmap
modf | mprotect | mrand48
msgctl | msgget | msgrcv
msgsnd | msync | munmap
Nnextafter | nftw | nice
nl_langinfo | nrand48 | ns_find_tsig
ns_sign | ns_sign_tcp | ns_sign_tcp_init
ns_verify | ns_verify_tcp | ns_verify_tcp_init
ntohl | ntohs | Oopen
opendir | openlog | openpty
Pp_query | path_casesensitive | pathconf
pause | pclose | perror
pipe | pmap_getmaps | pmap_getport
pmap_set | pmap_unset | poll
popen | pow | pread
printf | pthread_atfork | pthread_attr_destroy
pthread_attr_getdetachstate | pthread_attr_getguardsize | pthread_attr_getinheritsched
pthread_attr_getschedparam | pthread_attr_getschedpolicy | pthread_attr_getscope
pthread_attr_getstack | pthread_attr_getstackaddr | pthread_attr_getstacksize
pthread_attr_init | pthread_attr_setdetachstate | pthread_attr_setguardsize
pthread_attr_setinheritsched | pthread_attr_setschedparam | pthread_attr_setschedpolicy
pthread_attr_setscope | pthread_attr_setstack | pthread_attr_setstackaddr
pthread_attr_setstacksize | pthread_cancel | pthread_cleanup_pop
pthread_cleanup_push | pthread_cond_broadcast | pthread_cond_destroy
pthread_cond_init | pthread_cond_signal | pthread_cond_timedwait
pthread_cond_wait | pthread_condattr_destroy | pthread_condattr_getpshared
pthread_condattr_init | pthread_condattr_setpshared | pthread_cond_init
pthread_create | pthread_detach | pthread_equal
pthread_exit | pthread_getconcurrency | pthread_getschedparam
pthread_getspecific | pthread_join | pthread_key_create
pthread_key_delete | pthread_kill | pthread_mutex_destroy
pthread_mutex_init | pthread_mutex_lock | pthread_mutex_timedlock
pthread_mutex_trylock | pthread_mutex_unlock | pthread_mutexattr_destroy
pthread_mutexattr_getpshared | pthread_mutexattr_gettype | pthread_mutexattr_init
pthread_mutexattr_setpshared | pthread_mutexattr_settype | pthread_once
pthread_rwlock_destroy | pthread_rwlock_init | pthread_rwlock_rdlock
pthread_rwlock_timedrdlock | pthread_rwlock_timedwrlock | pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock | pthread_rwlock_unlock | pthread_rwlock_wrlock
pthread_rwlockattr_destroy | pthread_rwlockattr_getpshared | pthread_rwlockattr_init
pthread_rwlockattr_setpshared | pthread_self | pthread_setcancelstate
pthread_setcanceltype | pthread_setconcurrency | pthread_setschedparam
pthread_setschedprio | pthread_setspecific | pthread_sigmask
pthread_spin_destroy | pthread_spin_init | pthread_spin_lock
pthread_spin_trylock | pthread_spin_unlock | pthread_testcancel
ptsname | putc | putchar
putenv | puts | pututxline
putw | putwc | putwchar
putws | pwrite | Qqsort
Rradixsort | raise | rand
rand_r | rand48 | random
rcmd | read | readdir
readdir_r | readlink | readv
realloc | realpath | recv
recvfrom | regcomp | regerror
regexec | regfree | registerrpc
remainder | remove | rename
renamewtmpx | res_close | res_findzonecut
res_getservers | res_hostalias | res_init
res_isourserver | res_mkquery | res_nclose
res_ninit | res_nmkquery | res_nmkupdate
res_nquery | res_nquerydomain | res_nsearch
res_nsend | res_nsendsigned | res_nupdate
res_ourserver_p | res_pquery | res_query
res_querydomain | res_search | res_send
res_setservers | res_update | rewind
rewinddir | rexec | rindex
rint | RMD160Data | RMD160End
RMD160File | RMD160Final | RMD160Init
RMD160Transform | RMD160Update | rmdir
rpc | rresvport | ruserok
Ssbrk | scalb | scalbn
scalbnf | scandir | scanf
sched_get_priority_max | sched_get_priority_min | sched_yield
seed48 | seekdir | select
sem_destroy | sem_getvalue | sem_init
sem_post | sem_timedwait | sem_trywait
sem_wait | semctl | semget
semop | send | sendto
setbuf | setbuffer | setegid
setenv | seteuid | setgid
setgrent | sethostent | setitimer
setjmp | setkey | setlinebuf
setlocale | setlogmask | setmode
setnetent | setpgid | setpriority
setprotoent | setpwent | setregid
setreuid | setrlimit | setsecret
setservent | setsid | setsockopt
setstate | settimeofday | setuid
setuser | setutxent | setvbuf
SHA1Data | SHA1End | SHA1File
SHA1Final | SHA1Init | SHA1Transform
SHA1Update | shmat | shmctl
shmdt | shmget | shutdown
sigaction | sigaddset | sigblock
sigdelset | sigemptyset | sigfillset
sighold | sigignore | sigismember
siglongjmp | sigmask | signal
significand | sigpause | sigpending
sigprocmask | sigrelse | sigset
sigsetjmp | sigsetmask | sigsetops
sigsuspend | sigvec | sigwait
sin | sinf | sinh
sleep | snprintf | sockaddr_in
socket | socketpair | sprintf
sqrt | sqrtf | srand
srand48 | srandom | sscanf
stat | statvfs | stdarg
strcasecmp | strcasestr | strcat
strchr | strcmp | strcoll
strcpy | strcspn | strdup
strerror | strerror_r | strfmon
strftime | stripdomainprefix | strlcat
strlcpy | strlen | strmode
strncasecmp | strncasestr | strncat
strncmp | strncpy | strpbrk
strptime | strrchr | strsep
strsignal | strsigname | strspn
strstr | strtod | strtok
strtok_r | strtol | strtoul
strunvis | strvis | strvisx
strxfrm | svc_destroy | svc_freeargs
svc_getargs | svc_getreq | svc_getreqset
svc_register | svc_run | svc_sendreply
svc_unregister | svcerr_auth | svcerr_decode
svcerr_noproc | svcerr_noprog | svcerr_progvers
svcerr_systemerr | svcerr_weakauth | svcfd_create
svcraw_create | svctcp_create | svcudp_bufcreate
swab | symlink | syscall
sysconf | syslog | system
Tt_accept | t_alloc | t_bind
t_close | t_connect | t_error
t_free | t_getinfo | t_getprotaddr
t_getstate | t_listen | t_look
t_open | t_optmgmt | t_rcv
t_rcvconnect | t_rcvdis | t_rcvrel
t_rcvudata | t_rcvuderr | t_snd
t_snddis | t_sndrel | t_sndudata
t_strerror | t_sync | t_unbind
tan | tanf | tanh
tcdrain | tcflow | tcflush
tcgetattr | tcgetpgrp | tcsendbreak
tcsetattr | tcsetpgrp | tdelete
telldir | tempnam | tfind
tgetent | tgetflag | tgetnum
tgetstr | tgoto | time
times | tmpfile | tmpnam
toascii | tolower | toupper
towlower | towupper | tputs
truncate | tsearch | tsig
ttyname | ttyname_r | ttyslot
twalk | tzset | Uualarm
uidtontsid | ulimit | umask
uname | ungetc | ungetwc
unixpath2win | unlink | unlockpt
unsetenv | unvis | user_from_uid
usleep | utime | Vvarargs
verr | verrx | vfork
vfprintf | vfscanf | vis
vprintf | vscanf | vsnprintf
vsprintf | vsscanf | vsyslog
vwarn | vwarnx | Wwait
waitpid | warn | warnx
wcs_access | wcs_chdir | wcs_chmod
wcs_chown | wcs_chroot | wcs_fnmatch
wcs_lchown | wcs_link | wcs_lstat
wcs_mkdir | wcs_mkfifo | wcs_mknod
wcs_open | wcs_opendir | wcs_pathconf
wcs_readlink | wcs_regcomp | wcs_regexec
wcs_remove | wcs_rename | wcs_renamewtmpx
wcs_rmdir | wcs_stat | wcs_statvfs
wcs_symlink | wcs_unlink | wcs_utime
wcscasecmp | wcscasewcs | wcscat
wcschr | wcscmp | wcscoll
wcscpy | wcscspn | wcsdup
wcsftime | wcslcat | wcslcpy
wcslen | wcsncasecmp | wcsncat
wcsncmp | wcsncpy | wcspbrk
wcsrchr | wcssep | wcsspn
wcsstr | wcstod | wcstok
wcstol | wcsntombs | wcstombs
wcstoul | wcswcs | wcswidth
wcsxfrm | wctomb | wctype
wcwidth | winpath2unix | write
writev | Xxdr | xdr_accepted_reply
xdr_array | xdr_authunix_parms | xdr_bool
xdr_bytes | xdr_callhdr | xdr_callmsg
xdr_char | xdr_destroy | xdr_double
xdr_enum | xdr_float | xdr_free
xdr_getpos | xdr_inline | xdr_int
xdr_long | xdr_opaque | xdr_opaque_auth
xdr_pmap | xdr_pmaplist | xdr_pointer
xdr_reference | xdr_rejected_reply | xdr_replymsg
xdr_setpos | xdr_short | xdr_string
xdr_u_char | xdr_u_long | xdr_u_short
xdr_union | xdr_vector | xdr_void
xdr_wrapstring | xdrmem_create | xdrrec_create
xdrrec_endofrecord | xdrrec_eof | xdrrec_skiprecord
xdrstdio_create | xprt_register | xprt_unregister
Yy0 | y1 | yn
Zz_abs |  |

See Also

  • Utilities and SDK for Subsystem for UNIX-based Applications in Microsoft Windows Vista RTM, Windows Vista SP1, and Windows Server 2008 RTM


Anonymous Users and Traverse Checking

On computers running Microsoft® Windows Server® 2008 R2, Windows® 7, Windows Server® 2008, Windows Vista®, Windows Server® 2003, and Windows XP operating systems, the Everyone group no longer includes anonymous users by default. This change reduces the number of network resources available by default to anonymous users and simplifies how network administrators can control access by anonymous users.

Implications of limiting anonymous access

With the default denial of anonymous user access, it is easier for administrators to configure a secure system.

The default access control lists (ACLs) on earlier versions of Windows that granted the Everyone group access to resources, and potentially exposed them to attack, no longer grant this access to anonymous users after the computer has been upgraded to the Windows Server 2008, Windows Vista, or later Windows operating systems.

Anonymous users cannot accidentally be granted access to resources as in the past, when administrators may not have been aware that anonymous users were included in the Everyone group.

This change affects anonymous users who are attempting to access resources hosted on computers running Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP. When a Windows 2000-based system is upgraded to any of these operating systems, resources with ACLs that grant access to everyone (and not explicitly to Anonymous Logon), are no longer available to anonymous users after the upgrade. In most cases, this is an appropriate restriction of anonymous access.

You can still allow anonymous access to selected shared directories and files by adding the Anonymous Logon group to the discretionary access control lists (DACLs) that protect those resources. In addition, you should grant the Bypass Traverse Checking user right to the Anonymous Logon group. For more information, see Bypass traverse checking for anonymous users.

In some situations, it may be difficult to determine which resources must grant anonymous access, or to modify the permissions on all the necessary resources. If so, you can configure Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP to permit anonymous access by the Everyone group. For more information, see Allow anonymous access by the Everyone group.

Bypass traverse checking for anonymous users

The procedure in this section applies to Windows 7 and Windows Vista.

To bypass traverse checking for anonymous users

  1. Click Start, type gpedit.msc in the Start Search text box, and then press ENTER.

  2. In the Local Group Policy Editor console tree, open Computer Configuration, open Windows Settings, open Security Settings, open Local Policies, and then click User Rights Assignment.

  3. In the details pane, right-click Bypass traverse checking, and then click Properties.

  4. Click Add User or Group.

  5. In the Select Users, Computers, or Groups dialog box, in the Enter the object names to select box, type Anonymous Logon.

  6. Click Check Names to verify that your entry is valid, and then click OK.

    Note

    There is no command-line method for this procedure.

Allow anonymous access by the Everyone group

The procedure in this section applies to Windows 7 and Windows Vista.

To allow anonymous access by the Everyone group

  1. Click Start, type gpedit.msc in the Start Search text box, and then press ENTER.

  2. In the Local Group Policy Editor console tree, open Computer Configuration, open Windows Settings, open Security Settings, open Local Policies, and then click Security Options.

  3. In the details pane, right-click Network access: Let Everyone permissions apply to anonymous users, and then click Properties.

  4. To allow permissions that are applied to the Everyone group to apply to anonymous users, click Enabled.

    - or -

    To prevent permissions that are applied to the Everyone group from applying to anonymous users, click Disabled.

  5. Click OK.

    Note

    There is no command-line method for this procedure.