0

I am currently setting up a network share. The permissions are working well. Users are unable to access folders unless they are within a certain active directory group.

My one issue is with local admin logins. I have a small staff that performs regular server maintenance. These users are in the "Domain Admins" group. Once they log into the server, they can edit the permissions of the local folder. This is than enabling them to view the files. I am the only Enterprise admin. I do trust the individuals but I can not allow them to view these files under any circumstance.

I have thought about just auditing permission changes as a deterrent, but that just seemed silly.

I have also thought of using a program like FolderLocker. However, that will only work if there is one user reading the files. That will work at this current time but not in the future.

Improve this question

2 Answers 2

Reset to default
1

No. There's no good way of keeping domain admins from being domain admins. By definition, domain admins are entrusted with the entire domain and all of its contents.

If you have to disallow domain admins from viewing the files, you would need to protect the files in a way that was completely outside of Active Directory. For instance, encrypt the files, or store the files in a SQL Server, etc.

Improve this answer
1
  • Thanks. What can I use to encrypt these files? I need it to be located on a network share. I also need to be able to access the files if a person leaves the company. I am not looking for a how to, just a nudge in the right direction. Thanks again.
    – Eddie M
    May 31, 2013 at 17:36
0

You could use a program like Puppet to ensure that the permissions are set on that Directory and if changed, get set back to the specified settings, or use a scheduled task or group policy to check the permissions (using icacls for instance), and set them back if they have been altered. Do these users need to be domain admins? Perhaps it is worth reevaluating that since you are not confident that they won't botch settings on the server.

Improve this answer
1
  • My supervisors and the owner of the company want tight restrictions on the files. These files are personal records. I think that encryption is my best bet at this point. Thanks
    – Eddie M
    May 31, 2013 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .