Software

Ask something
Question Locked

Protect files from the Domain Admin

0 helpful
4 replies

by albybara

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello there,
I'm not experienced in Domain Admin.
Just wondering if there is any way to protect some files from being accessed by a Domain Admin if my machine is in that domain.
I can use the local admin account to create these files (so Administrator ownership) but my question is: can the Domain Admin take the ownership of those files? Then change the permissions and read/copy or access them in any way?

Is there any way to protect private documents from being accessed if the machine belong to a domain? [ADDED] maybe filesystem encryption? Is there any other way?

Thanks!

4 replies

by daevansjr

TrueCrypt is the best thing I have found for this situation.

by oh smeg

As this is a Business system installing any unauthorized software may very well result in your Instant dismissal for breaching the companies Security.

If I had setup this system you couldn't install any software to begin with anyway.

The bottom line here is that the Domain Admin has access to everything that they want/need to look at. If you prevent the Domain Admin from looking at anything you are breaching the Security Model of the Company and in all business that I have ever been involved with this means Instant Dismissal and depending on the situation possible Legal Action to recover Damages.

Now that you understand that, what are you doing that you need to hide from the Domain Admin? That is probably also grounds for dismissal.

Col

by cg it

with a key and only if you have the key can you read the file.

There are particular types of files in which a domain admin or even an enterprise admin has no business viewing such in the case of medical files or company financial records.

Often, these files have specific rights and permissions assigned to them as well as being encrypted and domain admins as well as enterprise admins are excluded from those rights and permissions [though take ownership is on right that can't really be taken away].

If you have a legitimate business need to have files encrypted, then you should follow protocol. If you don't and you hide/encrypt files, as Oh Smeg mentions, your company probably has some rules about that.

The final answer is domain admins and enterprise admins will be able to "see" the file or folder but if encrypted, will not be able to open it. That doesn't mean they can't get rid of it, move it, quarrentine it, etc, just that they won't be able to open it [and then that's not really true, they could probably get the key if they really wanted to and it's an MS Office Suite file [Word, Excel, Access, etc].

This discussion is closed to new replies.