Delegating Windows permissions to different groups of administrators [closed]

Question

We have some Windows servers. They are running all sorts of services, DNS, SQL Server, IIS, Oracle, etc.

We want to setup a few AD groups, say DBA, WebAdmin and SAPAdmin.

Then, we want to delegate these groups to have just enough permissions on those Windows Server. Here are some examples

1. DBA can only start/stop services on Oracle database related service and SQL Server related services but not others
2. DBA can launch the Oracle/SQL Server related software but not others
3. DBA can install/uninstall Oracle/SQL Server related patches but not others
4. DBA can touch the database files or related registry but not others on the same server (e.g. web server)

Similar requirement for WebAdmin and SAPAdmin. Currently, we allow all these users logging onto the server box and do their job but unfortunately, we cannot figure out a way to completely lock down all the permissions. I can set the ACL for services, registry and files to fulfill part of my requirement.

I have two problems now.

1. I still cannot figure out a way to prevent users from executing unrelated software or installing unrelated software/patches.

2. I still cannot figure out a way to block a particular snapin from executing. I can block a exe file from executing by setting its ACL but I cannot block a particular snapin by setting the ACL on its DLL

If there is no way to solve the above problems directly, I am happy to take any workaround. The bottomline is to grant the least privilege to each of the groups and avoid different group of people from screwing up other people's software on the shared server.

Answer 1

Unfortunately, you will be pretty stuck with Windows servers - the operating system design will simply not let you do what you need to do to achieve "least privilege" in many cases. Although you certainly could configure software restriction policies to prevent unauthorized applications from running and set up group policies to allow users to start / stop certain services, there would be plenty of problems you would encounter in the daily admin work:

1. installation of most patches probably will require "Administrator" privileges and would not settle with "normal" user rights even if the user has "full control" access to the program directory
2. due to the very simplistic resource management features in Windows Server (you can't limit the amount of memory or CPU time given to user's processes) DBAs still would be able to perform actions on the server which would severely impair other running processes
3. if you make your DBA users local administrators, no matter what actions you perform to "lock them down", they will be able to circumvent any limitation and break out of any jail by design

As already indicated by bot403, administrative separation is best done by setting up a dedicated server with the least possibility of interference with unrelated services. Virtualization should help you with this, although at the cost of memory and processing overhead. You could minimize the overhead by not fully virtualizing hosts, but using containers which would allow you a sufficient level of resource management and administrative separation. Take a look at Parallels Virtuozzo for an example of what this could look like.