I am looking for means to prevent my Windows administrator from accessing my files. My plan is to cipher my files with EFS. As far as I know administrator can access ciphered files if he has EFS recovery agent role. So I'm worried about the possibility that admin can grant himself recovery agent permissions, steal data and take permissions away. My research shows that in that case my files would have a recovery agent information entry in it's metadata and admin has no means to delete it. So at least I can detect the steel post factum. The potential opportunity to detect steel gives me enough sense of security. Am I right? Please review my deductions.
closed as off topic by Sven♦, Lucas Kauffman, Tim Brigham, Shane Madden♦, Ward♦ Apr 26 '12 at 17:51
Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.
Your first problem is you have an administrator that you don't trust. This is a human resources issue, and you may need to take it up as such.
Second, you could only "protect" them by placing the files in a volume that's encrypted separate from Windows (encapsulating the data). There are methods to do this and products to do so if you google for it.
Do you own this material? Or is it company owned? Are you in effect stealing from the company?
And beyond that, this material could still be copied, and the computer could be monitored via keystroke capture and monitored remotely through screen capture/viewer programs, both of which are usually allowed in most countries because in the workplace, your employer owns the computer and the network.
You need to take this up with your employer. The sysadmin has full access to the computer, and the employer owns the resources. Whatever your issue is with the sysadmin you need to work that out without a technology solution.
Nothing would prevent the admin to install keyloggers etc., and you wouldn't even notice, so: No, your assumptions are wrong.
An "untrusted" administrator should be getting his rights revoked. There are tons of other ways to steal data if you have full rights on a server.