0

Is there some way to require a group of users to confirm their password (or prompt them for an elevated password) when deleting files off some directories on the file server?

We're having an issue with agents in one department deleting necessary files prematurely. There's ongoing work trying to retrain them not to blindly click through the delete confirmation (my preferred solution), and their process is being looked at to see if we can remove the need to delete at all, but we need an immediate (if temporary) solution to satisfy one of our customers that it won't happen again.

We can take away directory delete permissions without stopping their work-flow, but until the process gets overhauled they still need individual file delete.

I can't find a combination of search keywords that pulls up related questions - I keep getting questions about deleting user accounts, preventing deletion completely, or about removing the delete prompt rather than strengthening it.

5
  • 3
    They have the permissions required to delete files. Prompting them to authenticate in order to exercise that permission seems counterintuitive. If you don't want them to delete files then don't grant them that permission. That being said, I don't know of a way to do what you're looking for. This is a people problem, not a technical problem.
    – joeqwerty
    May 19, 2015 at 14:35
  • Give them the read-only flag & some agent (like team leader) the modify flag
    – yagmoth555
    May 19, 2015 at 14:35
  • What's to say that if you found a solution that they wouldn't just blow through that?
    – joeqwerty
    May 19, 2015 at 14:36
  • @joeqwerty It's definitely a training problem, and that's the only long term solution, no argument. We're looking for an emergency solution for the next few days while we retrain everyone; we have an upset customer so not having a potential process hole while retraining is ongoing would be... nice.
    – Jerril
    May 19, 2015 at 14:56
  • 1
    @Yagmoth555 So far I think that's our best option right now; can you post that as an answer so I can select it?
    – Jerril
    May 19, 2015 at 14:57

2 Answers 2

0

Give them the read-only flag & some agent (like team leader) the modify flag.

nb, We do that at our job in helpdesk team, or team that got a high number of new employees per year. (as usually those post get newcomer hired in the enterprise). That give time to those team leader to train the agent correctly.

0

Enable file history so deleting a files is no longer a recovery problem.

3
  • Unfortunately we can't do that for security/privacy rules imposed on us by external groups.
    – Jerril
    May 21, 2015 at 13:23
  • I'd like to understand how filehistory impacts security/privacy, but letting non dataowners aka teamleaders get access (IMHO a far larger data security issue) isn't.
    – Jim B
    May 22, 2015 at 15:37
  • "Bureaucratic inertia", possibly with a sprinkling of security theatre. However, that's the contract we have :P
    – Jerril
    May 25, 2015 at 12:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .