Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have some Windows servers. They are running all sorts of services, DNS, SQL Server, IIS, Oracle, etc.

We want to setup a few AD groups, say DBA, WebAdmin and SAPAdmin.

Then, we want to delegate these groups to have just enough permissions on those Windows Server. Here are some examples

  1. DBA can only start/stop services on Oracle database related service and SQL Server related services but not others
  2. DBA can launch the Oracle/SQL Server related software but not others
  3. DBA can install/uninstall Oracle/SQL Server related patches but not others
  4. DBA can touch the database files or related registry but not others on the same server (e.g. web server)

Similar requirement for WebAdmin and SAPAdmin. Currently, we allow all these users logging onto the server box and do their job but unfortunately, we cannot figure out a way to completely lock down all the permissions. I can set the ACL for services, registry and files to fulfill part of my requirement.

I have two problems now.

  1. I still cannot figure out a way to prevent users from executing unrelated software or installing unrelated software/patches.

  2. I still cannot figure out a way to block a particular snapin from executing. I can block a exe file from executing by setting its ACL but I cannot block a particular snapin by setting the ACL on its DLL

If there is no way to solve the above problems directly, I am happy to take any workaround. The bottomline is to grant the least privilege to each of the groups and avoid different group of people from screwing up other people's software on the shared server.

share|improve this question

closed as not a real question by Shane Madden, MikeyB, MDMarra, Chris S, Ward Oct 19 '11 at 22:48

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

I don't know if I detect a question in there or not. – TylerShads Oct 19 '11 at 19:31
Yes. This is how Principal of Least Privilege works. Very normal for the System Admin to setup in any network environment, part of their job... – Chris S Oct 19 '11 at 19:35
@Shads0 Sorry, I updated my questions. hope that make my questions clearer – Harvey Kwok Oct 19 '11 at 19:48
Can you split the servers so each server does exactly one job? Then you dont have to worry about the DBA accidentally touching the IIS stuff because thats a different server. Virtual servers could help here. – bot403 Oct 19 '11 at 20:04
@bot403 I have quite a lot of servers. It requires quite a lot of work to split all the servers. I can probably do that but is it the only way to achieve the goal? – Harvey Kwok Oct 19 '11 at 20:33
up vote 3 down vote accepted

Unfortunately, you will be pretty stuck with Windows servers - the operating system design will simply not let you do what you need to do to achieve "least privilege" in many cases. Although you certainly could configure software restriction policies to prevent unauthorized applications from running and set up group policies to allow users to start / stop certain services, there would be plenty of problems you would encounter in the daily admin work:

  1. installation of most patches probably will require "Administrator" privileges and would not settle with "normal" user rights even if the user has "full control" access to the program directory
  2. due to the very simplistic resource management features in Windows Server (you can't limit the amount of memory or CPU time given to user's processes) DBAs still would be able to perform actions on the server which would severely impair other running processes
  3. if you make your DBA users local administrators, no matter what actions you perform to "lock them down", they will be able to circumvent any limitation and break out of any jail by design

As already indicated by bot403, administrative separation is best done by setting up a dedicated server with the least possibility of interference with unrelated services. Virtualization should help you with this, although at the cost of memory and processing overhead. You could minimize the overhead by not fully virtualizing hosts, but using containers which would allow you a sufficient level of resource management and administrative separation. Take a look at Parallels Virtuozzo for an example of what this could look like.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.