Situation: 2 x Windows 2000 Server Domain Controllers in the same domain (1 is file/print, 1 is Exchange 2000). On the file server, the shared partition has a directory structure broken down by department. In other words, under the root of the share, there are subdirectories for each department which correspond to that department’s group membership. Therefore, permissions restrict each user to the groups (departments) they belong in.
Desired Outcome: We have Executive and Accounting groups (departments) for which we want group members to have permission, BUT NO ONE ELSE. This includes the Administrator.
The problem here is that our Administrator has to have access to the servers and all settings, etc. But we don’t want them to have access at all to the Executive or Accounting directories. We’ve tried locing them down and specifically excluding the Administrator, but thet would still have the ability to add themselves to the group or take ownership…
This security is imperative.
Thanks!
Cougster