With a default installation of Microsoft Deployment Toolkit (MDT) the Deployment Share is not secure. All users are allowed to read / write which makes it vulnerable to unauthorized access and possibly exposes access to (installation) passwords.

The default permissions on a folder are:

• Administrators – Full Control
• CREATOR OWNER – Full Control
• SYSTEM – Full Control
• Users – Read & Execute + Create file / write data + Create Folders / append data

Active Directory Groups

It is recommended to change the ACL of the Deployment Share to limit access for a selection of users. The easiest way to achieve this is to create Active Director groups. Access to the MDT Deployment Share is then maintained via Active Directory, which is managed centrally, instead of each object individually.

For example the following groups can be used:

Permissions

Permissions on the Deployment Share can be granted to Active Directory groups, below you will find an example based on the example groups.

I’m assuming the Deployment Share is stored in the root of drive D:.

Block inheritance

First start with disabling inheritance to avoid permissions from parent objects to propagate to the Deployment Share folders.

The screenshot if of a Windows Server 2012 machine, but the same applies to other Windows operating systems.

D:\DeploymentShare

D:\DeploymentShare\Capture

The ImageCapture group needs sufficient privileges to create a new image capture.

D:\DeploymentShare\Logs

Both the Deploy and ImageCapture groups require write access to the log files. Without write access the deployment will fail.

Disclaimer

I’m pretty sure the permissions can be more tight then the example I provided in this article. However, it is more secure then a default installation without any modification. Feel free to provide me with detailed privileges and I’m more then happy to update the article.

.