Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for means to prevent my Windows administrator from accessing my files. My plan is to cipher my files with EFS. As far as I know administrator can access ciphered files if he has EFS recovery agent role. So I'm worried about the possibility that admin can grant himself recovery agent permissions, steal data and take permissions away. My research shows that in that case my files would have a recovery agent information entry in it's metadata and admin has no means to delete it. So at least I can detect the steel post factum. The potential opportunity to detect steel gives me enough sense of security. Am I right? Please review my deductions.

share|improve this question

closed as off topic by SvW, Lucas Kauffman, Tim Brigham, Shane Madden, Ward Apr 26 '12 at 17:51

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

9  
Social/human resource problems cannot be solved through technological solutions... –  Bart Silverstrim Apr 26 '12 at 17:43
    
Unless you're the owner / a director, you don't own the data on your computer, the company that employes you does, and it's hired this admin to manage its network, and that includes having access to the data on all the computers on the network if they need it to do their job. If you feel this person is being unprofessional, you should address it through your line manager. If you're the owner / a director level employee then you should have the employee removed from their job if you can't trust them. Playing around with encryption is no solution. –  RobM Apr 26 '12 at 18:40
add comment

3 Answers 3

Your first problem is you have an administrator that you don't trust. This is a human resources issue, and you may need to take it up as such.

Second, you could only "protect" them by placing the files in a volume that's encrypted separate from Windows (encapsulating the data). There are methods to do this and products to do so if you google for it.

BUT

Do you own this material? Or is it company owned? Are you in effect stealing from the company?

And beyond that, this material could still be copied, and the computer could be monitored via keystroke capture and monitored remotely through screen capture/viewer programs, both of which are usually allowed in most countries because in the workplace, your employer owns the computer and the network.

You need to take this up with your employer. The sysadmin has full access to the computer, and the employer owns the resources. Whatever your issue is with the sysadmin you need to work that out without a technology solution.

share|improve this answer
add comment

Nothing would prevent the admin to install keyloggers etc., and you wouldn't even notice, so: No, your assumptions are wrong.

share|improve this answer
add comment

An "untrusted" administrator should be getting his rights revoked. There are tons of other ways to steal data if you have full rights on a server.

share|improve this answer
1  
I would wonder why he's untrusted...is this an employee interaction issue? Political? Company problem? –  Bart Silverstrim Apr 26 '12 at 17:42
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.