File security / Administrator lockout

Why whould you want to do such a think. Since this will basicly disable the option of ever recovering what you are trying to protect, so it defeats the purpose of security. Thats why by design its impossible to do.
Any system is designed in such a way that the administrator can always take ownership of every file. Which also implies that he can change permissions, once he can change permissions he can grant himself what you rejected which will result in givning him access. After all thats why the administrative account is there. You can however purchase a 3rd party program that will encrypt what ever you want. That way even the administrator will not be able to access the file.
Now back to the original question: Why whuold you want to dosuch a think?
If there are people that know the administrative Password and you want to lock them out from certain areas, then change the administrative password. If the reason is because that person needs some administrative permissions. Then grant them those permsissions, In Windows NT (in Active Direcotry its even more flexible) you can assing someone permission to do backup, which will give him some degree of access but not enough to take ownership of files. You can also assign someone to the account operators group which will give him permissions to add and or delete and or reset user accounts and or passwords. But will not give him administrative access.
If the problem is because you don't trust your administrator then the only choice is to fire him.

You can acomplish this by creatin groups in NT and assigning user to the groups. Then grant permissions for groups. That way user will have access based on thier group membership.
For example:
User A needs access to file A and B
user B needs access to file B only
user C needs access to file A only
create group 1 and group 2, grant group 1 access to file A grant group 2 access to file B. Make user A a member of group 1 and 2. Make user B a member of group 2. Make user C a member of group 1.
Another example:
User A needs read write delete permissions on file A.
User B needs only read permissions on file A.
Create group 1 and group 2.
grant group 1 Read Write Delete permissions on file A.
Grant group 2 just Read Permissions on fileA.
make user A member of group 1.
make user B member of group 2.

You will however have to make sure that you:
1. Change the administrators password, so no one uses it to bypass security.
2. Give every one a user name AND password.
3. Create the group and assign the permissions (based on the groups) on the files and/or folders.
If you use Win9x machines as the clients, you will have to make sure that the clients logon to their local machines using the username and password that exists on the NT machine. If you use a domain controller this can be done very easily.

I have set up folders for Finance-type people before and I know of their desire to lock their stuff down so tight Admins can't get in. Like we would EVER do something so horrible as change the amount our year-end bonus would be!!! Never!!! :-)
Anyway, I am a little confused when you say "NT will not let you lock out the admin. from adding themselves to the local group." With NTFS security permissions, it is easy for an Admin to lock him/herself out.
So, here is my suggestion, albeit a drastic one.
Go to the machine that the physical files for Finance reside (a file server, for example) and modify the NTFS security permissions on the root folder that contain the files to only give the Finance users access. Remove Everyone group, and theAdministrator(s) group and/or Administrator account. Just leave in your Finance users.
Sounds like you are using NT so you won't have any security inheritance permissions to deal with. Just change the root folder.
Then show the Finance people whatyou did, that they are the only ones who have rights to get in.
Next, stand at the file server with a head Finance person and try to open the folder; let them see it fail. They will like that, trust me!

Now, you might be wondering about the Administrators right to take ownership of files and folders. With this right, any member of the Administrators group can take ownership of any file/folder and give him/herself access.
First, don't mention this right to the Finance people. Let them live in ignorance on this fact. If they don't know that you can always get into the folders in case of an emergency, so much the better.
Now, if they DO know about this right, then open up User Manager for Domains, go to Policies -> User Rights, and REMOVE the Administrator group from having the Take Ownership of File and Folders right!
This is the drastic step here.
Now show the Finance people that you can't take ownership of t

Answer 4 still doesn't help. Now I'll tell you why:
1. Since I'm the administrator I can always grant myself permissions to take ownership of files.
2. Since I'm the administrator I can still reset the password from anyone else and gain complete access loging on using thier username/password.
3. Since I'm the administrator I'll just make you problems on your computer, Like make sure that you progrmas don't run, right? since you are assuming that I'll steal from you, why do you assume I'll not try to steal if there is a way to access the file and you just want to take advantage of your own ignorance. No isn't that the reason you want to lock me out?
4. I can just boot up the computer with a Linux Boot disk, gain access to the NTFS protected (?) file and copy it modify it copy it back.
Bottom line you rejected because you are ignorant and don't beleive me.
The only way around the administrator is to use a 3rd party program (as I said earlier) to encrypt the files (You can't use Windows 2000 EFS since the Administrator has access to this as well). Also denying access for the admin also means that it never gets backed up. Which brings us to the conclusion that I mentioned in my first answer:
If you deny access to the administrator, you defeat the porpuse of securtiy. The only way things will be secure is if the administrator HAS access to files. Of course you have to make sure you can trust him.

Thats exactly what I'm trying to tell you. There is no way on doing this.
Looks like you having been readin what I'm writing. My spelling is bad because I never finnished school.

I think you can do this using EFS (Encryption File System), part of the Microsoft NTFS file system. EFS is a transparent public key encryption technology that works in conjunction with NTFS permissions to grant and deny users access to files and folders in Windows NT, 2000 and XP operating systems.
EFS uses a public key and a private key for encryption. If the user does not have one, the EFS service generates the key pair automatically. Files can be encrypted individually, or a folder can be designated as encrypted, so that any file written to that folder is automatically encrypted. Because EFS's encryption technology integrates into the file system, users can't access the hard disk without going through the file system.
EFS is not available in Windows versions 95, 98 or Me as these operating systems use the FAT16 and FAT32 file systems

I would recommend that you go to http://www.webopedia.com and lookup EFS. There are some great links that explain in detail how to use this &what it can do. In particular the Step-by-Step guide to EFS, which is a Microsoft TechNet site that explains it.

Let me know if that helps

My email is chikara89@cox.net