We have some Windows servers. They are running all sorts of services, DNS, SQL Server, IIS, Oracle, etc.
We want to setup a few AD groups, say DBA, WebAdmin and SAPAdmin.
Then, we want to delegate these groups to have just enough permissions on those Windows Server. Here are some examples
- DBA can only start/stop services on Oracle database related service and SQL Server related services but not others
- DBA can launch the Oracle/SQL Server related software but not others
- DBA can install/uninstall Oracle/SQL Server related patches but not others
- DBA can touch the database files or related registry but not others on the same server (e.g. web server)
Similar requirement for WebAdmin and SAPAdmin. Currently, we allow all these users logging onto the server box and do their job but unfortunately, we cannot figure out a way to completely lock down all the permissions. I can set the ACL for services, registry and files to fulfill part of my requirement.
I have two problems now.
I still cannot figure out a way to prevent users from executing unrelated software or installing unrelated software/patches.
I still cannot figure out a way to block a particular snapin from executing. I can block a exe file from executing by setting its ACL but I cannot block a particular snapin by setting the ACL on its DLL
If there is no way to solve the above problems directly, I am happy to take any workaround. The bottomline is to grant the least privilege to each of the groups and avoid different group of people from screwing up other people's software on the shared server.