SBS 2007 Administrator

I have an adminstration problem on SBS 2007. One of my customer's senior managers wants a section of the file system which contains sensitive files to be inaccessible to the system administrator. Unfortunately there is a need for both the system administrator and one of the operations staff to know the admin password and the manager does not want the operations staff member to be able to access some folders or to be able to make any changes that would enablem them to access them. I have suggested using encryption but he is very reluctant. I changed the ownership of the folders containing the sensitive files and removed the administrator from the ACL but this caused problems with backup and was difficult to administer as the system adminstrator had to change the ownership and reset the ACL etc. I have pointed out that to the best of my knowledge that the administrator or a user who is a member of the administrators group can get access to any part of the filesystem by seizing ownership and then changing the folder/file permissions. So denying the administrator access to the sensitive files was actually not achieving very much and was causing problems. It would be helpful if anyone could confirm (or rebut) my assumption about the administrator being able to get access to any part of the filesystem and any suggestion as to how I could resolve this problem.

Thanks

John
jhswinsonAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

GeodashCommented:
With a domain admin password, any file or folder on the system cab be "seized" and he can make himself an owner.

If you really want to lock him out, you would need to change DA passwords and remove him from the DA group. Without doing this, he will always be able to gain permissions if he knows where the files/folders are located. This is working as intended for DA's

Being a domain admin, you can change anyone's password on the domain. You can deny his account privileges but a new account can be created and/or a password changed with someone that has permissions, and the files accessed.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jhswinsonAuthor Commented:
This confirms what I thought and is very useful as a "second opinion" to convice staff that the answer to the problem is encryption.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.