We have a MS Windows Server 2008 R8 based server that is administrated by our IT department. We would like to achieve two things simultaneously:

  • A folder on the server, containing several thousand files (new files added frequently) that is accessible to some ActiveDirectory users (e.g. board of directors) but is not accessible by IT department employees
  • IT department employees still maintain rights to administrate the server, including installing new software and services

We already checked some solutions:

  1. Using NTFS access rights. Unfortunately IT (members of "Administrators" group) can set themselves as new owners of the files and change the permissions so that they gain access to the files.
  2. Enabling EFS. Unfortunately even if you do not allow IT to access files, they still can disable EFS completely because they have administrative rights. Moreover as far as I know you have to manually add permissions for all users but the owner for each new file - very inconvenient.
  3. Creating a new role for the IT department that has all the privileges apart from taking ownership of files. Unfortunately if you're not a member of the Administrators group, you cannot install new software, no matter what privileges you add to the role.
  4. TrueCrypt - nice free encryption software, but with poor sharing capabilities. You can either mount an encryption container on the server (and then IT has access to its contents) or you mount them locally but only one user can mount it for writing.
  5. AxCrypt - free encryption software that enables file-by-file encryption on the server. There are some disadvantages though - you have to manually encrypt each new file added. The files have their extensions changes. You can only set one password for all files (so all users have to know this one password).

Any other ideas? Our budget is limited so enterprise-class software from Symantec or PGP would probably be not an option.


It's not possible to give the IT employees full access whilst keeping the folder inaccessible to them. Therefore you need to give them a limitation in some way. Because they have physical access to the server this needs to be through means of encryption -- it may be inconvenient, but there are only two ways to stop access to data which someone has physical access to -- encryption or physical limitation.

I can't think of another way around this.

  • Thanks for the tip. What kind of encryption solution would you recommend?
    – Paweł
    Dec 21 '10 at 17:20
  • I personally use TrueCrypt, but you're right, it's not very flexible in a networking environment, I don't think any encryption solution will be due to the very nature of it. The better way of doing it may be EFS or BitLocker, I've seen EFS deployed on some networks before, but I'm not sure of the ins and outs of it.
    – neurolysis
    Dec 21 '10 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy