Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As I understand it, if a user creates a folder they become the owner and can control NTFS permissions including removal of inherited permissions granted to Domain Admins.

What is the best approach to prevent Domain Admins from being denied access to network folders? These are some of the approaches I have read about:

  1. You shouldn't be trying to prevent users from changing permissions on the folders they create.
  2. Schedule a script that takes over ownership of any folders that Domain Admins cannot access (sidebar question: if you change owner does that replace [i.e. remove] the ACE that granted full control to the original owner?).
  3. Use a combination of Share permissions change and read) and NTFS permissions (modify) to limit Authenticated Users' ability to change permissions as described by Helge Klein.
share|improve this question
    
Is this a real problem that you're currently dealing with or is this based on something you read somewhere? –  joeqwerty Jul 4 '11 at 22:10
    
real problem - trying to analyse network folders and I hit over 500 ACLs where access was denied to Domain Admins (who belong to Administrators group). –  zen Jul 4 '11 at 22:15
add comment

2 Answers

This seems more like a management issue than a technical one. Taking ownership with a script or trying to block the few people that would ever play with permissions is more trouble than I think it would be worth.

In the past, we've made personal folders completely inaccessible to domain admins, but there are inevitably times when people call up and ask "can you check something in my personal directory?"

So we follow a policy that admins have to be able to read everything (with a few exceptions). If we ever come across a folder where someone has blocked admin access, we find out why, explain why we think it's better that we have access, and we change the permissions back to our default. If it happened while we were tracking down a problem, that's why we have the policy: so we could simply take control at the time and sort it out later.

share|improve this answer
    
My guess is that the problem exists because the Domain Admins group didn't have permissions at the parent folder rather than a deliberate act on someone's part to lock out the Domain Admins group. –  joeqwerty Jul 4 '11 at 22:26
    
@Ward - agree that this is a management issue in that it is up to the corporate entity to decide if they want to block admin access to certain data; however, when you do need admin access it needs a technical solution that is practical and doesn't cause more problems like blocking access to the original owner. –  zen Jul 4 '11 at 22:33
    
I'd agree that it's a management problem but I subscribe to the notion that "Administrators / Full Control" should be on every filesystem ACL for shared folders. It's just too handy and, because an "Administrator" can always grant themselves such access anyway there's no reason not to just have the permission there to begin with. Any sense of "security" that having "Administrators / Read" on files / folders is a false sense of security, at best. –  Evan Anderson Jul 4 '11 at 22:35
    
@joeqwerty - I suspect the reasons are varied although in my case I don't think it was a management decision to remove Domain Admin access. I think in some cases certain "power users" took it upon themselves to "clean up" the list of ACEs on their folders. Irrespective of the reasons, I still need to find a solution. –  zen Jul 4 '11 at 22:38
1  
@EvanAnderson: An administrator granting themselves ownership is an auditable action. Writing to a file if they already have privilege very rarely is. For that reason, universal admin access should be read-only. –  Ben Voigt Nov 10 '11 at 3:12
show 3 more comments

on option you could deploy is simply hiding the permissions tab through group policy. It won't stop a really creative user, but it will quickly weed out the majority that might tinker around. other that that, there's no need to worry about owenership so long as the admins have full control. As mentioned, you can always take ownership.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.