We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on call 24x7. However, it has recently become an issue of company policy that there are certain folders or files (salary data, performance reviews, accounting info) that should be confidential, including from IT staff. This also includes the data on backups (tape and disk).
Things that have occurred to us so far:
*EFS - but we'd have to set up a PKI, which is a bit overkill for our company size
*TrueCrypt - but this kills concurrent access and search-ability
*Remove Domain Admins from the ACLs - but this is extremely easy (one click) to bypass
*Dropping use of the Domain Admins group, and delegating permissions more explicitly - but again this is a bit overkill, and we want to reduce the need for shared accounts (e.g., MYDOMAIN\Administrator) as possible for audit reasons
I'm sure this is not a novel problem, and am curious how other people with this sort of requirement have handled it? Are there any options that we haven't already considered?