bug#865: 23.0.60; The directory is unsafe today

[Lennart Borgman (gmail)]

Francis Litterio wrote:
> Eli Zaretskii wrote:
> 
>>> From: Francis Litterio
> 
>>> If this solution is implemented, keep in mind that there is a Group
>>> Policy setting called "System objects: default owner for objects created
>>> by members of Administrators group" which can be set to either
>>> "Administrators group" or "Object creator".  If it is set to the latter
>>> value, then newly-created files are owned by the user not the group.
>> Thanks.  Do you know which API can be used to find out
>> programmatically whether this setting is one or the other?
> 
> You had to ask. :) Some hours of Googling and reading bad MS
> documentation reveals that Windows sets the following registry value to
> 0 or 1 to reflect that particular policy:
> 
>   Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
>   Value: NoDefaultAdminOwner
> 
> If it is 0, then new files created by members of Local Administrators
> are owned by the group, otherwise they are owned by the user.

Is this the recommended way to check it? Quite often I have seen people
on Internet claiming that you should look for a registry value when the
documentation from MS clearly say you should use an API instead.

> Some caveats:
> 
> 1. I think that changing this value may have no effect on a machine in a
>    domain with restrictive domain policies, but that doesn't affect
>    Emacs, which would only read it.
> 
> 2. This value might not exist in the registry on Windows versions prior
>    to Windows XP.  That may be a bigger issue for Emacs.
> 
> Hope this helps.
> --
> Fran
> 
> 
> 
> 
> 
>