Solved

SBS 2007 Administrator

Posted on 2012-04-12
2
203 Views
Last Modified: 2012-04-16
I have an adminstration problem on SBS 2007. One of my customer's senior managers wants a section of the file system which contains sensitive files to be inaccessible to the system administrator. Unfortunately there is a need for both the system administrator and one of the operations staff to know the admin password and the manager does not want the operations staff member to be able to access some folders or to be able to make any changes that would enablem them to access them. I have suggested using encryption but he is very reluctant. I changed the ownership of the folders containing the sensitive files and removed the administrator from the ACL but this caused problems with backup and was difficult to administer as the system adminstrator had to change the ownership and reset the ACL etc. I have pointed out that to the best of my knowledge that the administrator or a user who is a member of the administrators group can get access to any part of the filesystem by seizing ownership and then changing the folder/file permissions. So denying the administrator access to the sensitive files was actually not achieving very much and was causing problems. It would be helpful if anyone could confirm (or rebut) my assumption about the administrator being able to get access to any part of the filesystem and any suggestion as to how I could resolve this problem.

Thanks

John
0
Comment
Question by:jhswinson
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 9

Accepted Solution

by:
Geodash earned 500 total points
ID: 37838835
With a domain admin password, any file or folder on the system cab be "seized" and he can make himself an owner.

If you really want to lock him out, you would need to change DA passwords and remove him from the DA group. Without doing this, he will always be able to gain permissions if he knows where the files/folders are located. This is working as intended for DA's

Being a domain admin, you can change anyone's password on the domain. You can deny his account privileges but a new account can be created and/or a password changed with someone that has permissions, and the files accessed.
0
 

Author Closing Comment

by:jhswinson
ID: 37850433
This confirms what I thought and is very useful as a "second opinion" to convice staff that the answer to the problem is encryption.
0

Featured Post

[Webinar] How Hackers Steal Your Credentials

Do You Know How Hackers Steal Your Credentials? Join us and Skyport Systems to learn how hackers steal your credentials and why Active Directory must be secure to stop them. Thursday, July 13, 2017 10:00 A.M. PDT

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the event you manage a Small Business Server 2003, and you are audited for PCI compliance, there are several changes you must make in order to pass the audit. I can take no credit for discovering any of these fixes or workarounds, but there is no…
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Small Business Server 2011. NOTE: This guide has been written using the preview version of SBS2011 therefore some of the screens may …
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question