As far as I understand and it was answered in this thread, that administrators still need an ACL to administer files even though they have the highest authority. On my system Administrators group is defined at the drive level with Full Control and Apply to all sub folders and files option. Now, I have an application folder that contains sensitive data. I don't want the Administrators to have access to that folder because of privacy concerns. Is it a common practice to exclude Administrators from such a folder? If yes, how will it affect the administrators daily tasks? I have an answer about managing permissions in the above link, but what about other tasks like backup/restore for example? Thanks.
If the administrators don't have an ACL giving them permission, they won't be able to access the file. But the administrators can take ownership of files, thus being able to set its permissions.
If you really want to prevent unauthorized access, you should use encryption. Note Windows EFS with keys issued by an internal Microsoft CA can also possibly be accessed by the CA administrators etc., so you might be looking for Truecrypt or Bitlocker (not sure how that one works in a "corporate environment") or GPG.
Usually you should trust your sysadmins and anyone in the server's local Administrators group as well. I've never done it in my environments (15 clustered services, ~80TB disk space, ~4000 shares), but that doesn't mean you can't do it. If there are only certain people that you're concerned about having access, you could create a (local or domain) group that contains those people and add an entry to the ACL for that folder that DENIES their access explicitly.
As for backups and such, so long as the account you're using for backups is in the
Backup Operators group, you should be fine. It's granted special permissions to be able to do certain things (backup, restore and shutdown the system) regardless of it's individual permissions on a given folder.
It all depends on where the folder is located. Is it a local folder?
Regarding backup, I think it depends on the technology being used.
And remember, if they are Administratros, they may be able to revert the security settings. Don't you worry about the people who have access to the backup too?