2

We have a long time fulltime employee going into working from home via Remote Desktop connection to her office (Win7 or Win8, don't quite recall) machine, that would work 24x7 for it. We think there would be a risk, that her home computer can possible get infected by viruses, or the children/guests can get access to it, then via her office desktop get access to internal services/servers and damage the information kept.

While the users are all described in Active Directory, the network shares are administered locally on all the servers (servers are in the domain, but the ACLs to their shared folders are locally created, not AD-pushed). Historically there were born quite a number of servers with accumulated information, and the user is member of several user groups, gaining her permissions both individually and via the groups.

Now we want to keep her profile and all the working environment she made on her office desktop, want to keep her local administration rights (software development, including installing and uninstalling of helper apps, managing shared folders on her PC, etc), want her to be able to research old files for for years accumulated information. But not to be able to modify them. At least not without some carefully planned circumvention activities (we fear neglect, not malevolence).

One way would be converting her user account from NT Domain user into local user. But that way ALL her network access grants would be removed unconditionally.

Another way, would be to tediously enumerate all the servers and all shares on those, and then adding NTFS "deny write" privileges on every of those for that user. This is tedious and this is fragile (any new shared folder created/tuned in the future, that would be shared to some of her user groups, would implicitly be accessible to her).

So I think that maybe AD or group policies have their own user-grained deny-SMB-write rules? Can we keep her profile in AD and in all the usergroups she currently is in, but by adding some personal rule to her account override all the current and future shared folders access grants, to enforce them all being read only?

Like "user xxx@domainyyy when accessing shared SMB folders others than (whitelisted folder(s)) should be denied all the writes, no matter which grants for the share were set for her or her usergroups there locally on the servers".

Is there such a functionality in NT domain or GPOs ?

Arranging that she would not be able to RDP from that her office desktop into another network machines, and then anchoring the same deny-SMB-write rule to her desktop account rather than user account would be okay too.

Domain Controllers are Windows 2003, the fileservers are 2003 or 2008 or 2008r2

Improve this question
10
  • 1
    I'm curious why you think that granting her remote access is a security concern? If you publish the Remote Desktop endpoint securely, this shouldn't be a problem. You're using something like an RD Gateway for this, I hope - right?
    – MDMarra
    May 31, 2017 at 11:36
  • we use some VPN and I am not quite sure how exactly. This legacy infrastructure was "somehow working", then finally admins were fired, some outsourcing company got contracted, but their on-site admin does not always have an in-depth knowledge, nor abundance of times he can dedicate to our company exclusively. So I am trying to find some kind of reasonable optimum, that 1) can be implemented by few days 2) would not disrupt that employee work patterns and environments 3) would give a reasonable protection 4) would not frame me as a de facto network admin (I have no time nor experience)
    – Arioch 'The
    May 31, 2017 at 11:41
  • So I have to find how to do it soft and fast way unless powers above me would maybe do it some hard way, like unplugging her station from the network wires (or actually moving to VPN-only VLAN). The situation might potentially, in the worst scenario, escalate to the "who would be responsible if from her computers some information on servers would get damaged". So the higher up the chain, the more I fear the "just cut off all the ropes" reaction.
    – Arioch 'The
    May 31, 2017 at 11:43
  • You should probably fix the fact that your Company doesn't have a full time sysadmin AND an outsourcing Company. "nor abundance of times he can dedicate to our company exclusively"... Anarchy!
    – Marco
    May 31, 2017 at 17:40
  • We think there would be a risk, that her home computer can possible get infected by viruses. Based on what I just read, I'm inclined to think her home computer is commensurate with or in better shape than the office computer systems. me as a de facto network admin (I have no time nor experience. The company should engage a technology professional.
    – Greg Askew
    May 31, 2017 at 18:12

1 Answer 1

Reset to default
2

"Is there such a functionality in NT domain or GPOs ?" The answer is: No.

To accomplish this goal: You should set ntfs and share permissions using GPOs on all servers. I won't explain how, the web is full of how-to's for this.

Then, an experienced admin can build a template so that a group called "GoodGuysFromOutsideThatMightHelpBadGuys" always preset ntfs and share denies on newly created shares via gpo.

Improve this answer
2
  • GPO policies are only applied on login/reboot which is not very often with servers. Then one can make some resident service, that would be deployed and run constantly on the servers, waiting for new shares to be created.... However, I hoped AD can just have the same positive and negative ACL rights as HTFS and SMB shares do, just centralized and... wildcarded, patterned. Sad if it does not...
    – Arioch 'The
    Jun 1, 2017 at 10:53
  • This is not particularly true :) technet.microsoft.com/en-us/library/cc940895.aspx
    – Marco
    Jun 1, 2017 at 10:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .