Warning about unsafe TeamCity data directory permissions

Symptoms

The following warning is shown:

Unsafe TeamCity data directory permissions
The following principals have write access to the TeamCity data directory (< TeamCity Data Directory Path>):
- ...
For security reasons, it is recommended to allow read and write access only to TeamCity and Administrator user accounts.

Cause

Users who have read access to the TeamCity Data Directory can access all the settings on the server, including configured passwords. Hence, it is recommended to make sure this directory is only readable by OS users who are actually administrators of the services.

This warning means that access to the TeamCity data directory is given to more users than required.

Resolution

Only the user account that is used to run the TeamCity Server service (or process) and the administrator need access to the TeamCity Data Directory.

For example, the TeamCity Windows installer modifies permissions of the TeamCity installation directory to not use inheritable permissions and explicitly grants access to the directory to the Administrators user group and the account under which the TeamCity Server Windows service is configured to run. It is strongly recommended to restrict permissions to the TeamCity Data Directory in the same way.