具有Everyone = READ的Windows文件使访问被拒绝

Question

I have a Java based application which creates a number of files on Windows under C:\\ProgramData... These files need to be readable by all users, guests, and automated scripts/programs not run by a user. One example file is "ca-trust.crt" which is created when the app runs as a Service (no service user is configured so its running as Local Machine context).

My app explicitly adds an ACL for group Everyone to have READ, READ+EXECUTE. However, my app gets "Access is denied" when trying to open the file to READ. The same thing happens if I run Powershell as a regular user and run "type C:\\ProgramData...".

See image below for permissions and "type ..." command output.

If I open PS prompt as Administrator and run "type C:\\ProgramData..." for the same file it works fine.

Opening the file with Notepad also fails:

The test system is Windows 10 Enterprise non-AD joined.

Answer 1

Adding SYNCHRONIZE to the ACL in addition to all the READ_* flags fixed the issue. Thank you eryksun!