Secure Your WDS Deployment Share

I discovered today that the Unattend.xml file containing the domain joiner account's password is stored in plain text on a share readable by any domain user. Obviously, that's a problem. Everything I read on the Internet seemed to indicate that that's just how it works and that I should use unsecure domain join (no authentication to domain controller) to avoid storing passwords. I'm not a big fan of that option either, so I messed around with folder permissions a bit.

I determined that it is in fact possible to change the security on the WDS share to allow only administrators and the system to read it. This doesn't break anything - I did a successful unattended deployment after making the change. (The WDS share can be found on the WDS server under the name RemInst.) Secure it!