1

As far as I understand and it was answered in this thread, that administrators still need an ACL to administer files even though they have the highest authority. On my system Administrators group is defined at the drive level with Full Control and Apply to all sub folders and files option. Now, I have an application folder that contains sensitive data. I don't want the Administrators to have access to that folder because of privacy concerns. Is it a common practice to exclude Administrators from such a folder? If yes, how will it affect the administrators daily tasks? I have an answer about managing permissions in the above link, but what about other tasks like backup/restore for example? Thanks.

2

If the administrators don't have an ACL giving them permission, they won't be able to access the file. But the administrators can take ownership of files, thus being able to set its permissions.

If you really want to prevent unauthorized access, you should use encryption. Note Windows EFS with keys issued by an internal Microsoft CA can also possibly be accessed by the CA administrators etc., so you might be looking for Truecrypt or Bitlocker (not sure how that one works in a "corporate environment") or GPG.

  • 1
    Neither TruCrypt or BitLocker will prevent un-authorized (or rather un-intended) access to files when the system is running since the encryption/decryption happens on the fly in the background and all files appear decrypted. These are mostly meant for data at rest encryption for laptops and such. You'd more be looking at something like McAfee's File and Removable Media Protection, which allows you to encrypt individual files/folders transparently only if you have the appropriate keys/software. – GregL Jan 26 '15 at 13:39
  • True. I understand Windows EFS can allow transparent access by other authorized users too. The only drawback I can think of is in a corporate environment the Windows CA allows for admins to take or revoke access as the keys are stored in the CA and controllable by "the corporation". – spuk Jan 26 '15 at 13:53
0

Usually you should trust your sysadmins and anyone in the server's local Administrators group as well. I've never done it in my environments (15 clustered services, ~80TB disk space, ~4000 shares), but that doesn't mean you can't do it. If there are only certain people that you're concerned about having access, you could create a (local or domain) group that contains those people and add an entry to the ACL for that folder that DENIES their access explicitly.

As for backups and such, so long as the account you're using for backups is in the Backup Operators group, you should be fine. It's granted special permissions to be able to do certain things (backup, restore and shutdown the system) regardless of it's individual permissions on a given folder.

  • I'm on the security team. It's not that I don't trust the people sysadmins. I'm trying to reduce the risks of their accounts being misused or compromised. It's called the Least Privilege concept. Get access to what you really need. On the other hand I don't want to raise unrealistic demands that would affect the administrators performance. Will you consider this request unrealistic? Thanks. – Bibi195 Jan 25 '15 at 18:39
  • As it is possible for Administrators to override the policy if I'm not mistaken, I'd rather focus on establishing a paper trail than limiting access. You can't enforce it on a technical level anyway. – fuero Jan 26 '15 at 12:58
  • I know the concept of least privilege, but security is always about balancing functionality and ease of of administration with limited access. Just because somebody has access to something doesn't mean they know about it, care about it or will abuse of it. Misuse/abuse shouldn't be prevented strictly with technology, but also covered in corporate policy to ensure abuse is dealt with appropriately. There'a always the risk of a privileged account being compromised, but in theory they should be limited in number, have known owners and strict password policies (if possible). – GregL Jan 26 '15 at 12:59
  • So you think it would be an excessive requirement? At this point I'm just trying to understand if giving Administrators Full Control to all files in the file system is a common practice. Thanks. – Bibi195 Jan 27 '15 at 1:41
  • I think it is, but it really depends on your corporate structure, AD delegation model and each person's responsibilities. A middle ground might be to create an AD group for the the people that are meant to manage the application and then grant that group Full Control to the folders in question, while leaving the Administrators group alone. The problem you'll eventually face (when, not if), is that somebody will break something and your sysadmins won't be able to go in and fix it. Well, not easily anyway. – GregL Jan 27 '15 at 14:06
0

It all depends on where the folder is located. Is it a local folder?

Regarding backup, I think it depends on the technology being used.

And remember, if they are Administratros, they may be able to revert the security settings. Don't you worry about the people who have access to the backup too?

  • If by local folder you mean not a share then yes it's a local folder. Yes, I do worry about backup accounts. Those are in my privileged accounts list and as fuero mentioned above I'm setting controls to monitor their activity. But as far as I understand backup accounts do need more or less constant access to the file system where setting ACL's can be done once and then have administrators manage user groups. In that case they don't need constant access to all folders. – Bibi195 Jan 27 '15 at 1:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.