Note that since TeamCity 2017.2 the TeamCity Windows installer modifies permisisons of the TeamCity installation directory not to use inheritable permissions and explicitly grants access to the directory to the Administrators user group and the accrount under which the service is configured to run.
It is strongly recommended to restrict permissions to the TeamCity Data Directory in the same way.
Additional security-realted related settings
Consider adding the
"teamcity.installation.completed=true" line into the
<TeamCity Home Directory
>\conf\teamcity-startup.properties file - this will prevent the server started with the empty database from granting access to the machine for the first coming user.