4

We're a small college, and I have one file share for an athletics team that I want to turn over to the coach. We don't track or have a group for athletic team members in Active Directory, and the coach wants to exclude certain people from certain sub-folders, so I want the coach to be able to add/remove accounts for his team directly in the security tab of the folder on his own. He knows enough and is tech-savvy enough to be able to handle this.

What I don't want him to be able to do is add/remove any of administration groups or special accounts: SYSTEM, Network Services (the folder is used with a web app), Domain Admins, AthleticDeptAdmin, etc.

Is it possible for me to give him access to change some of security options without giving access to remove those other permissions?

Improve this question

4 Answers 4

Reset to default
5

This is easy. As an example: make a sub folder called "Soccer" and make a matching group. Then delegate the ability for someone in athletics to add or remove users to the Soccer security group. As long as the Soccer group has sufficient access on the NTFS ACL for the Soccer folder, they won't need to touch file permissions at all.

People in the Soccer group will be able to see the Soccer sub folder.

enter image description here

enter image description here

Improve this answer
9
  • 2
    But he would still be able to remove Domain Admins from the Soccer subfolder, which the OP wants to prevent.
    – MDMarra
    Jul 18, 2012 at 18:36
  • I'm not sure if you read my two lines that I wrote. The solution of adding users to the soccer group, has nothing to do with changing permissions of the file. To explain this further, the domain admins create a folder called Soccer. Then they change the permissions to allow people from the group Soccer to do whatever. Now the coach would just need the permission to add users to the Soccer group. The coach wouldn't be allowed to change the permissions of the folder.
    – ponsfonze
    Jul 18, 2012 at 19:30
  • Your suggestion wasn't clear. It says to make the subfolder a group, which doesn't make sense. I understand what you're saying now, though. For the record, I'm not the one that downvoted you.
    – MDMarra
    Jul 18, 2012 at 19:33
  • 1
    @Joel Coel, re: "access to ADUC": Not that he'd know this, but you do know that normal domain users have rights to execute ADUC, right? Read-only privs, but still - unless you've changed the default domain settings, he already has the ability to "see" the full AD structure.
    – HopelessN00b
    Jul 18, 2012 at 21:33
  • 1
    I do know this, but most users don't know it and don't have it installed. I know it's just security through obscurity, but at the same time I don't like having the tool staring them in face.
    – Joel Coel
    Jul 18, 2012 at 21:52
3

The short answer is no. If a user can change permissions on something, they can change all the permissions. But if you trust the person to edit the permissions in the first place, can't you trust them not to screw them up by removing the important pieces? Or better yet, how about you trust them until they screw up. Then re-evaluate the situation.

The only technical way around this is to provide some sort of front-end for changing the permissions. The front-end has the "real" access to change permissions, but only lets the user change the permissions that should be editable. It's way overkill for something like this, but it would theoretically work.

*Edit: I should point out that even if they do remove Domain Admin privs from the folder, it doesn't mean you lose access forever. It just means your app is broken until someone realizes what happened and re-establishes the correct permissions. As Domain Admin, you'll always be able to reset the ownership of the folder and re-add the permissions.

Improve this answer
2

No.

If you have access to change the permissions, you can change the permissions, including the permissions of admins and special accounts.

An alternative that may work for you is to set up the folder to inherit permissions from a parent folder that he can't change the permissions on. Define the permissions you don't want him to be able to change up there, and propagate those permissions down. Of course, he would be able to disable inheritable permissions and remove those permissions, but there's really not a lot you can do about that... other than telling him not to, and warning him that if he does, you'll revoke his permissions-changing access, and be applying the permissions you feel are appropriate from then on.

(I've found that pretty effective - "Here's your access, don't do [blah] with it, or generally screw around with it, because if you do, I'll yank it and you will find yourself subject to my schedule, whims and general malevolence.")

EDIT: I actually had another thought for a possible solution, as I got assigned an AdminSDHolder problem. You could always write a script to check permissions on that directory tree at regular intervals (say every hour), seize ownership if necessary, and then reapply the permissions you want/need to be present in addition to what the coach wants.

Honestly seems like more trouble than it's worth to me, when it's so much easier to warn/threaten the user against dumbassery, but YMMV. And now that I think about it, this might be a solution to a problem in my environment too... so thanks for asking and bringing me to think of it.

Improve this answer
1

Setup a group for the Athletic Department, and give it the necessary permissions (or possibly multiple groups if you want to support different permission profiles such as Read Only, Read-Write, etc.). Then delegate control of the group in Active Directory so that the coach can add/remove users from that group.

First result on Google for delegating group control in AD: http://codeidol.com/active-directory/active-directory/Groups/Delegating-Control-for-Managing-Membership-of-a-Group/

Edit: I wanted to make it clear that you are creating the groups specifically for granting permissions, so you wouldn't want to use any existing Athletic Dept. groups.

Improve this answer
3
  • Not a bad suggestion, but it does still place a lot of the burden of doing the work on the IT admin, as permissions would have to be setup by IT in the first place, and any changes to those permissions would have to be done by IT, or the Coach/group group would need rights to change the permissions on folders they control, which brings us back to the original problem.
    – HopelessN00b
    Jul 18, 2012 at 19:31
  • @HopelessN00b, I think it would only be a lot of work for the IT admin if the permissions need to be more complex than just giving blanket access to the whole folder (e.g. subfolders with different permisisons). Maybe someone will post a better suggestion for OP.
    – jbuch
    Jul 18, 2012 at 20:08
  • 1
    I guess it's not exactly clear, but I took "wants to exclude certain people from certain sub-folders" as an indication that the permissions might not be uniform, or blanket. Generally better to over-design something than under-design it, IMO. You don't end up coming back to tweak your solution as much if you make it exceed the original requirements, and I'm lazy like that. Do it well enough the first time that you only end up doing it once.
    – HopelessN00b
    Jul 18, 2012 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .