Windows Forum

Ask something
Discussion Locked

Securing directory from admin.

0 helpful
12 replies

by cougster 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Situation: 2 x Windows 2000 Server Domain Controllers in the same domain (1 is file/print, 1 is Exchange 2000). On the file server, the shared partition has a directory structure broken down by department. In other words, under the root of the share, there are subdirectories for each department which correspond to that department's group membership. Therefore, permissions restrict each user to the groups (departments) they belong in.

Desired Outcome: We have Executive and Accounting groups (departments) for which we want group members to have permission, BUT NO ONE ELSE. This includes the Administrator.

The problem here is that our Administrator has to have access to the servers and all settings, etc. But we don't want them to have access at all to the Executive or Accounting directories. We've tried locing them down and specifically excluding the Administrator, but thet would still have the ability to add themselves to the group or take ownership...

This security is imperative.

Thanks!
Cougster

12 replies

by voldar

What you ask for is a little bit strange - once the administrator has no rights to the specific folder, if something is crashed or lost, then I suppose, you don't blame the administrator for the situation!! Any administrator has the right to "take Ownership" on every folder that resides on the partition of a server, but what I suggest you is to do the followings:
- add an AUDIT on access to the folders you want. Give rights to the manager or anyone else to access the audit logs. This way you/he'll be informed on every step that each user did to the folders.
I suppose you are asking this because you don't trust the administrator, otherwise I don't get your point.

by jackofalltech

Even if this were possible (which I don't think it is), I don't know ANY Admin who would allow this.
A Network Admin MUST be considered in the same priviledged class as Security Admins and System Programmers on a mainframe! In order to maintain the systems AND fix problems, they MUST have access to everything.
If you can't trust your Admin, its time to get a new Admin rather than trying bar access.

Ralph

by cougster

Would you want your admin to have access to sentitive personnel and payroll information?

by jeaster

You can kind of do this by adjusting the options under the security tab to not allow Administrators access to this folder. However, as an Administrator, someone could take ownership, and then reassign permissions so they can see the folders. It is not possible to truly lock the Admin out of the folder, but you can make their life more difficult.

by cougster

Again... Would you want your admin to have access to sentitive personnel and payroll information?

by timwalsh

In summary (as all these answers are correct as far as they go), the short answer is no, you cannot totally lock out the Administrator.

As you surmise, you CAN set permissions to exclude the Administrator. However, the owner of a file/folder can always modify the permissions of that file/folder. And the Administrator can ALWAYS "Take ownership" of ANY file/folder.

If there are sensitive files you don't want the administrator to see, you should consider encryption.

If you don't trust your Administrator to not go where you tell him not to go, he shouldn't be your Administrator.

by jackofalltech

The point is not whether I would want him/her looking at sensitive info. The point is I MUST be able to trust him/her NOT to even though he/she CAN.

Again, if you can't trust your Admin, get a new Admin. Don't try to lock him/her out because you CAN'T.

Ralph

by shmaltz

I have given answers to this problem on this forum many times before, in almost all the cases my answer was rejected, I assume that this answer will be no different. However, I still feel that it has to be said so some people start understanding.
If you hire someone as a Network Admin and you don't trust him, you better fire him right now, don't even finnish reading this post. Your Network Admin is the one that has you by your 8a11s. He is the ONE - and not you, the employer - that can make sure that there is no production done in your working environment. You are required to trust him. If you have files that you want that the admin shouldn't have access to then no backups can be done on it. You as an employer have 3 choices:
1. Go back to colloge and teach yourself computers, and don't hire a Network Admin, do it yourself.
2. You can purchase a program that encrypts those files, and only those who need access to it have a/the password to decrypt the files. That way it can even be backed up, but this comes at a price of: A. purchasing new programs. B. remembering another password (if you use the same authentication that you use for windows, the admin can reset your password). C. it is complicated, since it requires your admin to trouble shoot yet another program, and you will not be able to use the file with its program unless it is decrypted, which actualy means that during the day (when ppl work with the file) it is not encrypted at all. D. if the password is ever forgotten you cannot usualy decrypt it.
Please note: I didn't include the option of trusting your admin, since if at this point you still don't trust him, and you havn't fired him, please make sure that your network is still running fine.

by shmaltz

BTW, I forgot to mention: If you don't use a 3rd party encryption then you can't lock out the Admin. It CANNNOT be done in windows, even windows 2000 EFS will not work since the admin can alwyas recover the encryption keys.

This discussion is closed to new replies.