Windows Forum

Ask something
Discussion Locked

Security

0 helpful
11 replies

by lino767

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi:

The president of the company I work for approched me this morning and asked me to create a network drive or a folder that can not be accessed by users and Network Administrator. He wants this folder or drive to be highly secured, he wants only him and the VP's to have access. I can remove the rights of users form accessing the drive or folder but how can I prevent the Admin, I think I am(Admin)going to have the right to access it as long as I am the one who created it. Please help me if I am wrong + let me know if there is such a thing "Removing the right of the admin"from accessing a data.

11 replies

by quintar51

hi,
what if the president created the shared folder himself, removed the everyone group and didn't allow persmission to be inhertited to that folder. If he just adds himself along with the VP's, then that should work. Hope that helps.

by timwalsh

You can't TOTALLY prevent anyone with Administrator privileges from gaining access to a network resource through either access permissions or Group Policy if he is determined.

First, the "owner/creator" of a file/folder can set permissions for that file/folder unless specifically denied those permissions. If you created the folder for your boss, you are the "owner/creator." By default, only Administrators can take ownership of a file/folder that doesn't already belong to them. You can give this right to other users, but you can't limit the scope of this right.

Second, by default, Administrators have the right to take ownership of any file/folder, even if they don't have the right to access it. Once ownership is established, access permissions can be reset. You could take away the right to "take ownership" from Administrators, but again there is no way to limit the scope of this action; it would be universal. But then again, there is nothing to stop an Administrator from re-enabling this right.

The bottom line is that the Administrator has far-reaching powers in the administration of a network. There isn?t any easy way to limit those powers without jeopardizing the administrators ability to do his job.

The only way to accomplish the company president?s goals is through encryption: either using EFS as included with Win2K, or some third party system such as PGP. You then run the risk of losing the files if someone loses the key.

Good luck.

by parikshits

Hi
what exactly you should do is that create a folder on that network drive.
Share that and give full control on sharing permission to the VP group
and for NTFS permission also give full control rights only to the VPs' gropu.
Remove any other group added in permission tab
Hope it works for you.

by parikshits

Hi
what exactly you should do is that create a folder on that network drive.
Share that and give full control on sharing permission to the VP group
and for NTFS permission also give full control rights only to the VPs' gropu.
Remove any other group added in permission tab
Hope it works for you.

This discussion is closed to new replies.