protecting my files from root
I am looking for a solution to allow storing files with sensitive information on a remote server in such way that system administrators could not access the data.
In the first case the server would host an application working with the sensitive data, so users should use RDP to run it. In the second case users only need to access their shared folders.
I would prefer the server to remain within our AD infrastructure for the convenience of maintenance, etc. So admins could log in to the server, do anything but access the sensitive information (they may know about its presence though).
The solution I thought of is using TrueCrypt on a Windows 2003 terminal server, but when encrypted volumes are mounted they behave just like normal Windows volumes - meaning, admins have access to them.
I also thought of putting the server out of domain into a workgroup - then I can set up local user accounts and manage permissions accordingly. This, however, would add some complications in terms of maintenance.
I would appreciate your advice.