Welcome to Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications (SUA) is a source-compatibility subsystem for compiling and running custom UNIX-based applications on a computer running a Windows server-class operating system. You can make your UNIX applications fully interoperable with Windows in SUA with little or no change to your original source code.

Subsystem for UNIX-based Applications provides an operating system for Portable Operating System Interface (POSIX) processes. SUA, along with its package of support utilities (such as shells and a Telnet client) available for download on the Microsoft Web site, provides a complete UNIX environment. The download package includes a comprehensive set of scripting utilities, and a software development kit (SDK) designed to fully support the development capabilities of SUA and to provide a complete UNIX-based application development experience.

SUA also supports case-sensitive file names, job control, compilation tools, and the use of over 300 UNIX commands, utilities, and shell scripts. Because the subsystem installs separately from the Windows kernel, it offers true UNIX functionality without any emulation.

New features for Windows Server 2003 Release 2

New features for Windows Server 2003 Release 2 (R2) include the following:

  • Database (OCI/ODBC) library connectivity. SUA supports connectivity to Oracle and SQL Server from database applications by using the Oracle Call Interface (OCI) and the Open Database Connectivity (ODBC) standard.

  • Microsoft Visual Studio Debugger Extension for debugging POSIX applications. SUA includes support for debugging your POSIX processes using Visual Studio IDE.

  • Utilities based on SVR-5 and BSD UNIX environments. The SUA download package supports two different UNIX environments: SVR-5 and BSD.

  • Support for 64-bit applications. Using a process called thunking, SUA provides support not only for 64-bit applications running on a 64-bit operating system, but also default support for 32-bit binaries running on a 64-bit operating system.

For more information, and to download the scripting utilities and SDK, see the Microsoft Web site.

In this topic

  • Subsystem for UNIX-based Applications Overview

  • Installing and Using Utilities and SDK for Subsystem for UNIX-based Applications

  • Case Sensitivity in Subsystem for UNIX-based Applications

  • Setting setuid in Subsystem for UNIX-based Applications

  • POSIX Compliance in Subsystem for UNIX-based Applications

  • System Calls Supported by Subsystem for UNIX-based Applications


Subsystem for UNIX-based Applications Overview

Subsystem for UNIX-based Applications (SUA), the evolution of the Interix subsystem that formerly shipped with Windows Services for UNIX 3.5, is a multiuser UNIX environment that operates on computers running Windows. Subsystem for UNIX-based Applications and its accompanying utilities provide you with an environment that resembles any other UNIX system. It also includes case-sensitive file names, job control, compilation tools, and the use of over 300 UNIX commands and utilities and shell scripts. Because the Subsystem for UNIX-based Applications is layered on top of the Windows kernel, it offers true UNIX functionality without any emulation.

Installing Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications is available with Windows Server 2003 Release 2 (R2). You can install SUA using the procedures provided in the topic Install an optional component by using Add/Remove Windows Components.

Computing Environments with Subsystem for UNIX-based Applications

A computer running SUA provides two different command-line environments: the UNIX environment and the Windows environment. Applications run on specific subsystems and in specific environments. When you load Subsystem for UNIX-based Applications, you are using a UNIX environment; when you run applications on the Windows subsystem, you are using a Windows environment.

For example, when you use the Korn shell or C shell available with the download package Utilities and Software Development Kit (SDK) for UNIX-based Applications, or any other application that was compiled to run on SUA, you are using a UNIX environment. Among other things, this environment features case-sensitive file names and path names that use the format /usr/examples. For more information about the commands and utilities that are available in the Subsystem for UNIX-based Applications, see the Help files that ship with the download package Utilities and Software Development Kit (SDK) for UNIX-based Applications. This download package is available either from Microsoft Beta Place (http://beta.microsoft.com) or from the Microsoft Web site.

When you use the command processor cmd.exe, you are using the Windows environment. This environment includes case-insensitive file names, and path names that include drive letters, as shown in the following example: C:\SUA\usr\examples. For more information about path names in the Subsystem for UNIX-based Applications and Windows, see the Help files that ship with the download package Utilities and Software Development Kit (SDK) for UNIX-based Applications.

Porting Applications by Using Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications provides both the tools and the application programming interface (API) libraries for porting applications to run on Windows-based computers. With the Software Development Kit (SDK), which provides a front end for Microsoft Visual C++, you can have a UNIX environment for development, but still have the benefits of the native compiler for Windows. For more information about path names in Subsystem for UNIX-based Applications and Windows, see the Help files that ship with the download package Utilities and Software Development Kit (SDK) for UNIX-based Applications.

See Also

  • Installing and Using Utilities and SDK for UNIX-based Applications


Installing and Using Utilities and SDK for Subsystem for UNIX-based Applications

The download package available from the Microsoft Web site, Utilities and Software Development Kit (SDK) for UNIX-based Applications, is designed to work with the Subsystem for UNIX-Based Applications (SUA) component that ships with Microsoft Windows Server 2003 Release 2 (R2).

Components Included with Download Package

The download package contains the following components:

  • Base Utilities

  • SVR-5 Utilities

  • Base SDK

  • GNU SDK

  • GNU Utilities

  • UNIX Perl

  • Visual Studio Debugger Extension

In addition to the features provided in Windows Services for UNIX 3.5, the download package supports 64-bit application development with SUA. The download also enables development and porting of custom UNIX applications using the Windows Oracle Call Interface (OCI) and Windows ODBC libraries (collectively referred to as "mixed mode" throughout this document).

Base Utilities, GNU Utilities, SDK and UNIX Perl

These components include all utilities that formerly installed with Windows Services for UNIX 3.5. This consists of the nearly 300 BSD-based and optional SUA GNU utilities. Many of these utilities (approximately 80) are also available in 64-bit versions.

GNU components include utilities and SDK tools distributed under the terms of the GNU General Public License (GPL).

See the Help and release notes provided with the installation package for a complete listing of base utilities.

SVR-5 Utilities

This set consists of a Korn shell and approximately 150 utilities, most of which support SVR-5. These utilities currently are available in 32-bit versions, and may fail in specific 64-bit scenarios; however, the utilities run on WOW 64-bit platforms.

See the Help and release notes provided with the installation package for a complete listing of SVR-5 utilities.

Base SDK

The current release supports most of the libraries and headers installed with Windows Services for UNIX 3.5. These support both 32-bit and 64-bit SUA-related software migration and development.

This SDK consists of the following libraries and corresponding header files: Standard C Library, Standard C++ Library and Math Library. The C++ library and the math library are functional equivalents of those supplied by Microsoft as part of their Visual Studio environment. Standard C Library and Math Library are available for both 32-bit and 64-bit platforms. Standard C++ Library is available for both 32-bit and 64-bit binaries, and supports multithreaded applications.

Compiler Compatibility

The Base SDK package can be used with either the gcc (GNU C compiler) and g++ (GNU C++ compiler) compilers, or the Visual Studio 2005 compiler. Linking to shared objects is not supported with the Visual Studio 2005 compiler. The C++ library supplied with this package is compatible with the Visual Studio 2005 compiler, and can be used with c89.

The g++ compiler uses its own library for C++ compilation.

System Requirements

The Utilities and SDK for Subsystem for UNIX-based Applications package installs only on Windows Server 2003 R2.

The minimum system requirements for installing Utilities and SDK for Subsystem for UNIX-based Applications depends on which components you are installing and the file system of the disk where the components will be installed.

The maximum disk space required to install all Utilities and SDK for Subsystem for UNIX-based Applications components is approximately 350 MB.

Additional Requirements

  • To receive product support, you must install the latest Windows service pack before installing Utilities and SDK for Subsystem for UNIX-based Applications, and then continue to install additional Windows service packs as they become available.

  • You must install Utilities and SDK for Subsystem for UNIX-based Applications on a partition that is formatted with the NTFS file system. File system operations on FAT partitions are not supported.

  • It is recommended that the computer have at least 16 MB of RAM in addition to the recommended minimum configuration for the operating system.

Installation Options

You can choose one of the following installation options when installing Utilities and SDK for Subsystem for UNIX-based Applications:

  • Standard Installation

  • Custom Installation

The following table shows which components are installed on a computer as part of the standard installation (Standard) and which additional components are available as part of a customized installation (Custom). If you select the customized installation, you can choose not to install components that are automatically installed as part of the standard installation. These components can only be installed on Windows Server 2003 R2.

Component | Type of Installation
Base utilities | Standard
Base SDK | Standard
SVR-5 utilities | Custom
GNU utilities | Custom
GNU SDK | Custom
UNIX Perl | Custom
Visual Studio Debugger Extension | Custom
Note

If you are upgrading from Windows Services for UNIX 3.5, existing settings are saved during R2 installation, and are restored during the setup process for Utilities and SDK for Subsystem for UNIX-based Applications.

Installing Utilities and SDK for Subsystem for UNIX-based Applications by Using the Windows Interface

The following installation options are available:

  • Standard Installation

  • Custom Installation

Standard Installation

To perform a standard installation

  1. Download the Utilities and SDK for Subsystem for UNIX-based Applications either from Microsoft Beta Place or from the Microsoft Web site

  2. In the Utilities and SDK for Subsystem for UNIX-based Applications Wizard dialog box, click Next.

  3. In the User name text box, type your name. If the name of your organization does not show in the Organization field, enter the name of your organization.

  4. Read the End User License Agreement (EULA) carefully. If you accept the terms of the agreement, click I accept the terms in the License Agreement, and then click Next to continue installation. If you click I do not accept the License Agreement (Exit Setup), the installation procedure terminates.

  5. To install default Utilities and SDK for Subsystem for UNIX-based Applications components in the default directory, click Standard Installation, and then click Next. To customize your installation, see Custom Installation.

Custom Installation

To perform a custom installation

  1. Download the Utilities and SDK for Subsystem for UNIX-based Applications either from Microsoft Beta Place or from the Microsoft Web site .

  2. In the Utilities and SDK for Subsystem for UNIX-based Applications Wizard dialog box, click Next.

  3. In the User name text box, type your name. If the name of your organization does not show in the Organization field, enter the name of your organization.

  4. Read the End User License Agreement (EULA) carefully. If you accept the terms of the agreement, click I accept the terms in the License Agreement, and then click Next to continue installation. If you click I do not accept the License Agreement (Exit Setup), the installation procedure terminates.

  5. To install default Utilities and SDK for Subsystem for UNIX-based Applications components in the default directory, click Standard Installation, and then click Next (see Standard Installation in the preceding section). If you want to specify a different set of components or a different installation location, click Custom Installation, and then click Next.

  6. Click to fill the check boxes for each component that you want to install, and then click the appropriate option. If you do not want to install a component, click the icon next to the component, and then click Entire feature will not be available. When you are finished specifying the components to install, click Next.

  7. If you are installing the GNU Software Development Kit (SDK), read the information about the GNU Library General Public License carefully. If you want to install the GNU SDK, click Next to continue installation. To make changes to the components you have selected click Back.
Notes
  • After you have installed Utilities and SDK for Subsystem for UNIX-based Applications, you can install additional components or remove installed components.
  • Utilities and SDK for Subsystem for UNIX-based Applications components cannot be run from a network server. All files must be installed on the local computer.
  • Standard installation does not provide a complete UNIX development environment. To obtain all of the GNU compilers, build tools, and other SDK components, you must select Custom Installation and then select GNU SDK.
  • Once Utilities and SDK for Subsystem for UNIX-based Application is installed, setuid behavior is disabled by default. This affects the behavior of certain SUA programs.
  • In this installation, case sensitivity will not be enabled for object names (such as file names) in non-Win32 subsystems.

Installing Utilities and SDK for Subsystem for UNIX-based Applications by Using the Command Line

Perform the following step to start a command-line installation of the Utilities and SDK for Subsystem for UNIX-based Applications.

To perform a command-line installation

  • At a command prompt, enter the following:

    msiexec /i [path\]setup.msi [ADDLOCAL="component[,component...]"] {/qb|/q}

The following table describes the arguments and options for this command.

Argument/Option | Description
path | The fully qualified path of the Utilities and SDK for Subsystem for UNIX-based Applications setup.msi file. If you omit the path, the setup.msi file must be in the current directory.
/qb | Installs Utilities and SDK for Subsystem for UNIX-based Applications with a basic user interface. You must specify either the /q or /qb option; otherwise, the results will be unpredictable.
/q | Installs Utilities and SDK for Subsystem for UNIX-based Applications with no user interface or display. This option allows you to perform an unattended installation. You must specify either the /q or /qb option; otherwise, the results will be unpredictable.
Notes
  • This command completes only a standard installation.
  • For security purposes, all SUA services (also called daemons) are disabled by default. To manage SUA services, edit the /etc/inetd.conf file.

See Also

  • Microsoft Windows Server 2003 TechCenter
  • MSDN Servers and Enterprise Development


Case Sensitivity in Subsystem for UNIX-based Applications

In Windows-based operating systems, the names of most objects (such as files and directories) are case preserving, but case insensitive. That means you can use uppercase and lowercase characters when naming such objects, but Windows does not distinguish between names based on case alone. For example, you cannot have two files in the same directory named sample.txt and Sample.txt because Windows regards the names to be identical for the purposes of identifying files.

Case Sensitivity and Subsystem for UNIX-based Applications

The UNIX operating system, by contrast, is fully case sensitive, and so UNIX computers distinguish between object names when the only difference between those names is the case of characters used in the object names. On most UNIX computers, therefore, sample.txt and Sample.txt could be stored in the same directory, and the UNIX computer would distinguish between them when performing operations on the files. For example, the command rm S*.txt would delete Sample.txt, but not sample.txt.

In order to implement typical UNIX behavior, the Subsystem for UNIX-based Applications is normally case sensitive when working with file names. This can present security issues, particularly for Windows users who are accustomed to the case-insensitive conventions of Windows. For example, a Trojan horse version of edit.exe named EDIT.EXE could be stored in the same directory as edit.exe. If a user were to type edit at a Windows command prompt, the Trojan horse version (EDIT.EXE) could be executed instead of the standard version. If case sensitivity is enabled, Windows users should be made aware of this possibility.

Restoring Case Sensitivity Defaults

In Windows XP and in Windows Server 2003 operating systems, the default behavior of subsystems other than the Win32 subsystem is to be case preserving but case insensitive; in previous versions of Windows, such subsystems were fully case sensitive by default. To support standard UNIX behavior, you can change the default Windows XP and Windows Server 2003 behavior for non-Win32 subsystems when installing the base utilities that are part of the download package Utilities and SDK for Subsystem for UNIX-based Applications. If you enable case sensitivity and then subsequently uninstall the base utilities, setup restores the default, case-insensitive behavior of non-Win32 subsystems.

For more information about changing case sensitivity settings, see Configuring case sensitivity for file and folder names.


Setting setuid in Subsystem for UNIX-based Applications

On many systems, a root user or superuser has complete control of the system. Subsystem for UNIX-based Applications (SUA) does not recognize a root user. When the Portable Operating System Interface (POSIX) standard was developed, the concept of a root user was considered an administrative issue. Instead of a root user, the POSIX standard defines appropriate privileges for some operations.

In This Topic

setuid and setgid

Subsystem for UNIX-based Applications and Identities

Setup Considerations for setuid in Subsystem for UNIX-based Applications

setuid and setgid

The setuid and setgid mechanisms allow a program, when run, to adopt certain aspects of a security principal other than that of the user running the program. They allow the program to alternate these aspects between those of the invoking user and those of another security principal.

Appropriate privileges are distinct from this. The setuid and setgid mechanisms allow an application to control the answer to the question: "Who are you?" Appropriate privileges answer the question: "What can you do?"

Subsystem for UNIX-based Applications and Identities

In typical UNIX environments, there is exactly one user to whom all privileges are granted. That user, typically called root, has uid == 0. In SUA, all supported privileges on a given system are granted to users who are members of either the Administrators group or the Domain Administrators group on that system. You do not need to log on as Administrator. Any user with membership in either the Administrators group or the Domain Administrators group possesses root privileges. Not all privileges defined in POSIX or UNIX are available in SUA; that is, there are certain privileges that are not granted to any user.

Appropriate privileges are typically required for a variety of actions. These include accessing the file system, sending signals to other processes (process control), or changing the effective user identifier (UID) or group identifier (GID) for a process in order to change the ability of that process to perform certain actions.

According to the POSIX standard, a file has permissions that include bits to set a UID (setuid) and set a GID (setgid). If either or both bits are set on a file, and a process executes that file, the process gains the UID or GID of the file. When used carefully, this mechanism allows a nonprivileged user to execute programs that run with the higher privileges of the file's owner or group. When used incorrectly, however, this can present security risks by allowing nonprivileged users to perform actions that should only be performed by an administrator. For this reason, SUA does not support this mechanism by default. Instead, if you attempt to execute a file with either the setuid or setgid bit set, SUA does not execute the file and returns the error code ENOSETUID.

Setup Considerations for setuid in Subsystem for UNIX-based Applications

If you rely on an application that requires standard POSIX behavior, you can configure SUA to execute files with the setuid or setgid bits set. If SUA is configured in this way, when a process executes a file that has the setuid or setgid bit set, SUA constructs local security tokens for the process with the privileges assigned to the owner or group of the file. Because the tokens are local, they are not recognized by other computers on the network. This means that, even if the file is owned by a member of the Domain Administrators group, for example, the process does not have trusted access through Windows networking to other computers in the domain. Instead, the privileges will be effective only on the computer on which the process is running.

For example, a process executes a program file with its setuid bit set and owned by a member of the Domain Administrators group. If that program attempts to change a domain user's password, that attempt will fail because the security tokens of the process are local and so are not recognized by other systems in the domain. If, on the other hand, the program attempts to change a local user's password, the attempt will succeed because the file's owner is a member of the Domain Administrators group, which typically belongs to the local computer's Administrators group. For information about how to configure SUA to execute files with the setuid or setgid bits set, see the Help files that ship with the download package Utilities and Software Development Kit (SDK) for UNIX-based Applications.

For the setuid(2), setgid(2), and chroot(2) functions, a process must have the effective UID that maps back to the system account, the Administrator account for the local domain, or the Administrator account for the principal domain. The local Administrator account can only change the UID or GID to another ID in the same domain.

For chown(1), chmod(1), and chgrp(1), an account must have the Windows privileges SE_BACKUP and SE_RESTORE to perform make operations on files owned by another user or group, or to modify permissions on a file owned by another user. These permissions typically belong to the Administrator and Backup Operator accounts.


POSIX Compliance in Subsystem for UNIX-based Applications

Subsystem for UNIX-based Applications (SUA) provides a Portable Operating System Interface-compliant (POSIX-compliant) subsystem that runs UNIX shells, utilities, and applications natively alongside Windows applications. This topic describes some of the working considerations for users requiring a POSIX-compliant operating system.

POSIX Shell Compatibility

The SUA Korn shell follows traditional Korn shell behavior, which is almost identical to POSIX behavior. If you need strict POSIX conformance, which some work environments require, see the differences between the Korn shell and POSIX in the ksh(1) documentation in the Help files found in the download package Utilities and Software Development Kit (SDK) for UNIX-based Applications.

To get full POSIX.2 conformance from the Korn shell, you must run it in POSIX mode. To run the Korn shell in POSIX mode, either open the Korn shell with the -o posix option, run the command set -o posix from within the shell, or set the POSIXLY_CORRECT shell parameter.

POSIX conformance is not supported in the C shell. Unlike the Korn shell, the C shell has no POSIX-mode command options.

Traverse Checking of Directory Permissions

By default, Windows users have permissions to move through a directory tree, though they might not have permissions to access each directory in the path. On POSIX systems, you cannot access a directory unless you have permission to access every directory in the path to the directory. This POSIX behavior is known as traverse checking.

For example, if you do not have permission to access a directory, you cannot change the current directory to any of its subdirectories, even if you have permission to access the subdirectories. By default in Windows, you can change the current directory to any subdirectories for which you have permission.

In Windows, there is a special permission called the Traverse Folder/Execute File permission, which you can set for a user or group. You can configure this permission to allow or deny movement through a directory tree. The Traverse Folder permission takes effect only when the group or user is not granted the Bypass Traverse Checking user right in the Group Policy snap-in. In Windows 2000, by default, the Everyone group is given the Bypass Traverse Checking user right. In Windows XP and the Windows Server 2003 operating systems, the Administrators, Backup Operators, Everyone, Power Users, and Users groups are all given this right. For strict conformance with POSIX standards, remove the Bypass Traverse Checking right from all users and groups except Backup Operators. To conform to privileges granted to the root user on many other UNIX implementations, remove the Bypass Traverse Checking right from all users except Administrators and Backup Operators.


System Calls Supported by Subsystem for UNIX-based Applications

The syscall(2) function performs the system call whose assembly language interface has the specified number with the specified arguments. Symbolic constants for system calls can be found in the header file <sys/syscall.h>.

For more information about the syscall function, see the Help and release notes provided with the Utilities and Software Development Kit (SDK) for UNIX-based Applications installation package, available for download from the Microsoft Web site.

Supported System Calls

The following system calls are supported by Subsystem for UNIX-based Applications:

_control87 | _controlfp | _exit | _getInstallPath | _getInstallPath_Win | _prefixInstallPath | _prefixInstallPath_Win
_tolower | _toupper | Aa64l | abort | abs | accept | access
acos | acosh | alarm | alloca | alphasort | arc4random_addrandom | arc4random
arc4random_stir | asctime | asctime_r | asin | asinh | assert | atan
atan2 | atan2f | atanf | atanh | atexit | atof | atoi
atol | auth_destroy | authenticateuser | authnone_create | authunix_create | authunix_create_default | Bbasename
bcmp | bcopy | bind | bindresvport | blf_cbc_decrypt | blf_cbc_encrypt | blf_dec
blf_ecb_decrypt | blf_ecb_encrypt | blf_enc | blf_key | brk | bsearch | bzero
Ccabs | calloc | callrpc | catclose | catgets | catopen | cbrt
ceil | cfgetispeed | cfgetospeed | cfsetispeed | cfsetospeed | chdir | chmod
chown | chpass | chroot | clearerr | clnt_control | clnt_create | clnt_destroy
clnt_freeres | clnt_geterr | clnt_pcreateerror | clnt_perrno | clnt_perror | clnt_spcreateerror | clnt_sperrno
clnt_sperror | clnt_statclnt_broadcast | clnt_statclnt_call | clnt_statpmap_rmtcall | clntraw_create | clnttcp_create | clntudp_bufcreate
clntudp_create | clock | close | closedir | closelog | confstr | connect
copysign | copysignf | cos | cosh | creat | crypt | ctermid
ctime | ctime_r | cuserid | Ddaemon | dbm_clearerr | dbm_close | dbm_delete
dbm_error | dbm_fetch | dbm_firstkey | dbm_nextkey | dbm_open | dbm_store | des_cipher
des_setkey | difftime | dirfd | dirname | div | dlclose | dlerror
dlopen | dlsym | dn_comp | dn_expand | drand48 | drem | dup
dup2 | Eecvt | el_deletestr | el_end | el_getc | el_gets | el_init
el_insertstr | el_line | el_parse | el_push | el_reset | el_resize | el_set
el_source | encrypt | endgrent | endhostent | endnetent | endprotoent | endpwent
endservent | endutxent | env | env_alloc | env_array | env_cron | env_expand_win
env_free | env_get | env_login | env_put | env_putarray | env_set | env_strfree
env_t | env_unset | env_winlogin | erand48 | erf | erfc | err
errno | errx | exec | exec_asuser | execl | execl_asuser | execle
execle_asuser | execlp | execlp_asuser | execv | execv_asuser | execve | execve_asuser
execvp | execvp_asuser | exit | exp | expm1 | Ffabs | fabsf
fchdir | fchmod | fchown | fclose | fcntl | fcvt | fdopen
feof | ferror | fflush | ffs | fgetc | fgetln | fgetpos
fgets | fgetwc | fgetws | fileno | finite | finitef | flock
flockfile | floor | floorf | fmod | fnmatch | fopen | fork
forkpty | fp_nquery | fp_resstat | fpathconf | fprintf | fpurge | fputc
fputs | fputwc | fputws | fread | free | freeaddrinfo | freopen
frexp | fscanf | fseek | fsetpos | fstat | fstatvfs | fsync
ftell | ftime | ftok | ftruncate | ftrylockfile | fts_children | fts_close
fts_open | fts_read | fts_set | ftw | funlockfile | fwrite | Ggai_strerror
gamma | gamma_r | gcvt | get_myaddress | getaddrinfo | getbsize | getc
getcwd | getdate | getdtablesize | getegid | getenv | geteuid | getgid
getgrent | getgrent_nomembers | getgrgid | getgrgid_r | getgrgid_ex | getgrgid_nomembers | getgrnam
getgrnam_r | getgrnam_nomembers | getgroups | gethostbyaddr | gethostbyname | gethostent | gethostname
getitimer | getlogin | getlogin_r | getmode | getnameinfo | getnetbyaddr | getnetbyname
getnetent | getopt | getpass | getpdomain | getpeername | getpgrp | getpid
getppid | getpriority | getprotobyname | getprotobynumber | getprotoent | getpwent | getpwnam
getpwnam_r | getpwuid | getpwuid_ex | getpwuid_r | getrlimit | getrpcbyname | getrpcbynumber
getrpcent | getrpcport | getrusage | gets | getsecret | getservbyname | getservbyport
getservent | getsockname | getsockopt | getsubopt | gettimeofday | gettzenv | getuid
getutxent | getutxid | getutxline | getwc | getw | getwchar | glob
globfree | gmtime | gmtime_r | grantpt | group_from_gid | Hhcreate | hcreate_r
hdestroy | hdestroy_r | herror | hesiod | hesiod_end | hesiod_free_list | hesiod_init
hesiod_resolve | hesiod_to_bind | history | history_end | history_init | hostalias | hsearch
hsearch_r | hstrerror | hstrerror | htonl | htons | hypot | Iiconv
iconv_close | iconv_open | ieee | ieee_test | ilogb | index | inet_addr
inet_aton | inet_cidr_ntop | inet_cidr_pton | inet_lnaof | inet_makeaddr | inet_netof | inet_network
inet_ntoa | infnan | initstate | ioctl | iruserok | isalnum | isalpha
isascii | isatty | isblank | iscntrl | isdigit | isgraph | isinf
isinff | islower | isnan | isnanf | isprint | ispunct | isspace
isupper | isxdigit | iswalnum | iswalpha | iswblank | iswcntrl | iswctype
iswdigit | iswgraph | iswlower | iswprint | iswpunct | iswspace | iswupper
iswxdigit | Jj0 | j1 | jn | jrand48 | Kkill | killpg
Ll64a | labs | lchown | lcong48 | ldexp | ldiv | lfind
lgamma | lgamma_r | libm | link | listen | localeconv | localtime
localtime_r | lockf | log | log10 | log1p | logb | longjmp
lrand48 | lsearch | lseek | lstat | Mmadvise | major | malloc
math | mblen | mbsntowcs | mbstowcs | mbtowc | mctl | MD4Data
MD4End | MD4File | MD4Final | MD4Init | MD4Transform | MD4Update | MD5Data
MD5End | MD5File | MD5Final | MD5Init | MD5Transform | MD5Update | memccpy
memchr | memcmp | memcntl | memcpy | memmove | memset | minor
mkdev | mkdir | mkfifo | mknod | mktemp | mktime | mmap
modf | mprotect | mrand48 | msgctl | msgget | msgrcv | msgsnd
msync | munmap | Nnextafter | nftw | nice | nl_langinfo | nrand48
ns_find_tsig | ns_sign | ns_sign_tcp | ns_sign_tcp_init | ns_verify | ns_verify_tcp | ns_verify_tcp_init
ntohl | ntohs | Oopen | opendir | openlog | openpty | Pp_query
path_casesensitive | pathconf | pause | pclose | perror | pipe | pmap_getmaps
pmap_getport | pmap_set | pmap_unset | poll | popen | pow | pread
printf | pthread_atfork | pthread_attr_destroy | pthread_attr_getdetachstate | pthread_attr_getguardsize | pthread_attr_getinheritsched | pthread_attr_getschedparam
pthread_attr_getschedpolicy | pthread_attr_getscope | pthread_attr_getstack | pthread_attr_getstackaddr | pthread_attr_getstacksize | pthread_attr_init | pthread_attr_setdetachstate
pthread_attr_setguardsize | pthread_attr_setinheritsched | pthread_attr_setschedparam | pthread_attr_setschedpolicy | pthread_attr_setscope | pthread_attr_setstack | pthread_attr_setstackaddr
pthread_attr_setstacksize | pthread_cancel | pthread_cleanup_pop | pthread_cleanup_push | pthread_cond_broadcast | pthread_cond_destroy | pthread_cond_init
pthread_cond_signal | pthread_cond_timedwait | pthread_cond_wait | pthread_condattr_destroy | pthread_condattr_getpshared | pthread_condattr_init | pthread_condattr_setpshared
pthread_cond_init | pthread_create | pthread_detach | pthread_equal | pthread_exit | pthread_getconcurrency | pthread_getschedparam
pthread_getspecific | pthread_join | pthread_key_create | pthread_key_delete | pthread_kill | pthread_mutex_destroy | pthread_mutex_init
pthread_mutex_lock | pthread_mutex_timedlock | pthread_mutex_trylock | pthread_mutex_unlock | pthread_mutexattr_destroy | pthread_mutexattr_getpshared | pthread_mutexattr_gettype
pthread_mutexattr_init | pthread_mutexattr_setpshared | pthread_mutexattr_settype | pthread_once | pthread_rwlock_destroy | pthread_rwlock_init | pthread_rwlock_rdlock
pthread_rwlock_timedrdlock | pthread_rwlock_timedwrlock | pthread_rwlock_tryrdlock | pthread_rwlock_trywrlock | pthread_rwlock_unlock | pthread_rwlock_wrlock | pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared | pthread_rwlockattr_init | pthread_rwlockattr_setpshared | pthread_self | pthread_setcancelstate | pthread_setcanceltype | pthread_setconcurrency
pthread_setschedparam | pthread_setschedprio | pthread_setspecific | pthread_sigmask | pthread_spin_destroy | pthread_spin_init | pthread_spin_lock
pthread_spin_trylock | pthread_spin_unlock | pthread_testcancel | ptsname | putc | putchar | putenv
puts | pututxline | putw | putwc | putwchar | putws | pwrite
Qqsort | Rradixsort | raise | rand | rand_r | rand48 | random
rcmd | read | readdir | readdir_r | readlink | readv | realloc
realpath | recv | recvfrom | regcomp | regerror | regexec | regfree
registerrpc | remainder | remove | rename | renamewtmpx | res_close | res_findzonecut
res_getservers | res_hostalias | res_init | res_isourserver | res_mkquery | res_nclose | res_ninit
res_nmkquery | res_nmkupdate | res_nquery | res_nquerydomain | res_nsearch | res_nsend | res_nsendsigned
res_nupdate | res_ourserver_p | res_pquery | res_query | res_querydomain | res_search | res_send
res_setservers | res_update | rewind | rewinddir | rexec | rindex | rint
RMD160Data | RMD160End | RMD160File | RMD160Final | RMD160Init | RMD160Transform | RMD160Update
rmdir | rpc | rresvport | ruserok | Ssbrk | scalb | scalbn
scalbnf | scandir | scanf | sched_get_priority_max | sched_get_priority_min | sched_yield | seed48
seekdir | select | sem_destroy | sem_getvalue | sem_init | sem_post | sem_timedwait
sem_trywait | sem_wait | semctl | semget | semop | send | sendto
setbuf | setbuffer | setegid | setenv | seteuid | setgid | setgrent
sethostent | setitimer | setjmp | setkey | setlinebuf | setlocale | setlogmask
setmode | setnetent | setpgid | setpriority | setprotoent | setpwent | setregid
setreuid | setrlimit | setsecret | setservent | setsid | setsockopt | setstate
settimeofday | setuid | setuser | setutxent | setvbuf | SHA1Data | SHA1End
SHA1File | SHA1Final | SHA1Init | SHA1Transform | SHA1Update | shmat | shmctl
shmdt | shmget | shutdown | sigaction | sigaddset | sigblock | sigdelset
sigemptyset | sigfillset | sighold | sigignore | sigismember | siglongjmp | sigmask
signal | significand | sigpause | sigpending | sigprocmask | sigrelse | sigset
sigsetjmp | sigsetmask | sigsetops | sigsuspend | sigvec | sigwait | sin
sinf | sinh | sleep | snprintf | sockaddr_in | socket | socketpair
sprintf | sqrt | sqrtf | srand | srand48 | srandom | sscanf
stat | statvfs | stdarg | strcasecmp | strcasestr | strcat | strchr
strcmp | strcoll | strcpy | strcspn | strdup | strerror | strerror_r
strfmon | strftime | stripdomainprefix | strlcat | strlcpy | strlen | strmode
strncasecmp | strncasestr | strncat | strncmp | strncpy | strpbrk | strptime
strrchr | strsep | strsignal | strsigname | strspn | strstr | strtod
strtok | strtok_r | strtol | strtoul | strunvis | strvis | strvisx
strxfrm | svc_destroy | svc_freeargs | svc_getargs | svc_getreq | svc_getreqset | svc_register
svc_run | svc_sendreply | svc_unregister | svcerr_auth | svcerr_decode | svcerr_noproc | svcerr_noprog
svcerr_progvers | svcerr_systemerr | svcerr_weakauth | svcfd_create | svcraw_create | svctcp_create | svcudp_bufcreate
swab | symlink | syscall | sysconf | syslog | system | Tt_accept
t_alloc | t_bind | t_close | t_connect | t_error | t_free | t_getinfo
t_getprotaddr | t_getstate | t_listen | t_look | t_open | t_optmgmt | t_rcv
t_rcvconnect | t_rcvdis | t_rcvrel | t_rcvudata | t_rcvuderr | t_snd | t_snddis
t_sndrel | t_sndudata | t_strerror | t_sync | t_unbind | tan | tanf
tanh | tcdrain | tcflow | tcflush | tcgetattr | tcgetpgrp | tcsendbreak
tcsetattr | tcsetpgrp | tdelete | telldir | tempnam | tfind | tgetent
tgetflag | tgetnum | tgetstr | tgoto | time | times | tmpfile
tmpnam | toascii | tolower | toupper | towlower | towupper | tputs
truncate | tsearch | tsig | ttyname | ttyname_r | ttyslot | twalk
tzset | Uualarm | uidtontsid | ulimit | umask | uname | ungetc
ungetwc | unixpath2win | unlink | unlockpt | unsetenv | unvis | user_from_uid
usleep | utime | Vvarargs | verr | verrx | vfork | vfprintf
vfscanf | vis | vprintf | vscanf | vsnprintf | vsprintf | vsscanf
vsyslog | vwarn | vwarnx | Wwait | waitpid | warn | warnx
wcs_access | wcs_chdir | wcs_chmod | wcs_chown | wcs_chroot | wcs_fnmatch | wcs_lchown
wcs_link | wcs_lstat | wcs_mkdir | wcs_mkfifo | wcs_mknod | wcs_open | wcs_opendir
wcs_pathconf | wcs_readlink | wcs_regcomp | wcs_regexec | wcs_remove | wcs_rename | wcs_renamewtmpx
wcs_rmdir | wcs_stat | wcs_statvfs | wcs_symlink | wcs_unlink | wcs_utime | wcscasecmp
wcscasewcs | wcscat | wcschr | wcscmp | wcscoll | wcscpy | wcscspn
wcsdup | wcsftime | wcslcat | wcslcpy | wcslen | wcsncasecmp | wcsncat
wcsncmp | wcsncpy | wcspbrk | wcsrchr | wcssep | wcsspn | wcsstr
wcstod | wcstok | wcstol | wcsntombs | wcstombs | wcstoul | wcswcs
wcswidth | wcsxfrm | wctomb | wctype | wcwidth | winpath2unix | write
writev | Xxdr | xdr_accepted_reply | xdr_array | xdr_authunix_parms | xdr_bool | xdr_bytes
xdr_callhdr | xdr_callmsg | xdr_char | xdr_destroy | xdr_double | xdr_enum | xdr_float
xdr_free | xdr_getpos | xdr_inline | xdr_int | xdr_long | xdr_opaque | xdr_opaque_auth
xdr_pmap | xdr_pmaplist | xdr_pointer | xdr_reference | xdr_rejected_reply | xdr_replymsg | xdr_setpos
xdr_short | xdr_string | xdr_u_char | xdr_u_long | xdr_u_short | xdr_union | xdr_vector
xdr_void | xdr_wrapstring | xdrmem_create | xdrrec_create | xdrrec_endofrecord | xdrrec_eof | xdrrec_skiprecord
xdrstdio_create | xprt_register | xprt_unregister | Yy0 | y1 | yn | Zz_abs

See Also

  • Microsoft Web site


Anonymous Users and Traverse Checking Settings

On computers running Windows XP and Windows Server 2003 operating systems, the Everyone group no longer includes anonymous users by default. This change reduces the number of network resources available by default to anonymous users and simplifies how network administrators can control access by anonymous users.

Implications of Limiting Anonymous Access

With the default denial of anonymous user access, it is easier for administrators to configure a secure system.

The default access control lists (ACLs) on earlier versions of Windows that granted the Everyone group access to resources, and potentially exposed them to attack, no longer grant this access to anonymous users after the computer has been upgraded to Windows XP or Windows Server 2003 operating systems.

Anonymous users cannot accidentally be granted access to resources as in the past, when administrators may not have been aware that anonymous users were included in the Everyone group.

This change affects anonymous users attempting to access resources hosted on computers running Windows XP and Windows Server 2003 operating systems. When a Windows 2000-based system is upgraded to Windows XP or Windows Server 2003, resources with ACLs that grant access to everyone (and not explicitly to Anonymous Logon), are no longer available to anonymous users after the upgrade. In most cases, this is an appropriate restriction of anonymous access.

You can still allow anonymous access to selected shared directories and files by adding the Anonymous Logon group to the discretionary access control lists (DACLs) protecting those resources. In addition, you should grant the Bypass Traverse Checking user right to the Anonymous Logon group. For more information, see. To bypass traverse checking for anonymous users in Windows XP and Windows Server 2003 operating systems.

In some situations, it may be difficult to determine which resources must grant anonymous access, or to modify the permissions on all the necessary resources. If so, you can configure Windows XP and Windows Server 2003 to permit anonymous access by the Everyone group. For more information, see To allow anonymous access by the Everyone group in Windows XP and Windows Server 2003 operating systems.

To bypass traverse checking for anonymous users in Windows XP and Windows Server 2003 operating systems

  1. Click Start, point to Control Panel, point to Administrative Tools, and then click Local Security Policy (or Domain Security Policy on a domain controller).

  2. In the console tree, open Security Settings, open either Local Policies or Domain Policies, and then click User Rights Assignment.

  3. In the details pane, right-click Bypass traverse checking, and then click Properties.

  4. Click Add User or Group.

  5. In the Select Users, Computers, or Groups dialog box, type Anonymous Logon in the Enter the object names to select list box.

  6. Click Check names to verify that your entry is valid, and then click OK.

Note

There is no command-line method for this procedure.

To allow anonymous access by the Everyone group in Windows XP and Windows Server 2003 operating systems

  1. Click Start, point to Control Panel, point to Administrative Tools, and then click Local Security Policy (or Domain Security Policy on a domain controller).

  2. In the console tree, open Security Settings, open either Local Policies or Domain Policies, and then click Security Options.

  3. In the details pane, right-click Network access: Let Everyone permissions apply to anonymous users, and then click Properties.

  4. To allow permissions applied to the Everyone group to apply to anonymous users, click Enabled.

  5. Or, to prevent permissions applied to the Everyone group from applying to anonymous users, click Disabled.

  6. Click OK.

Note

There is no command-line method for this procedure.