bug#865: 23.0.60; The directory is unsafe today

[Francis Litterio <flitterio@gmail.com>]

Eli Zaretskii wrote:

>> From: Francis Litterio

>> If this solution is implemented, keep in mind that there is a Group
>> Policy setting called "System objects: default owner for objects created
>> by members of Administrators group" which can be set to either
>> "Administrators group" or "Object creator".  If it is set to the latter
>> value, then newly-created files are owned by the user not the group.
>
> Thanks.  Do you know which API can be used to find out
> programmatically whether this setting is one or the other?

You had to ask. :) Some hours of Googling and reading bad MS
documentation reveals that Windows sets the following registry value to
0 or 1 to reflect that particular policy:

  Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  Value: NoDefaultAdminOwner

If it is 0, then new files created by members of Local Administrators
are owned by the group, otherwise they are owned by the user.

Some caveats:

1. I think that changing this value may have no effect on a machine in a
   domain with restrictive domain policies, but that doesn't affect
   Emacs, which would only read it.

2. This value might not exist in the registry on Windows versions prior
   to Windows XP.  That may be a bigger issue for Emacs.

Hope this helps.
--
Fran