Printable View
I have several admins who I need to keep out of several HR folders. I need to know how I can keep them as admins (domain admins), but not allow them to modify permissions on those folders. I am finding that after I set the permissions on the folder, they can be changed (by the admin) to allow that admin access to the HR folders. All MS Win 2k Machines if that helps.
As far as I am aware if you are the administrator, a member of the domain administrators group, or a member of the local administrators group you can give yourself rights to anything on that box.
Put these administrators into a group. Then under the permissions for the folder explicitly deny access for the users in that group. This is just a suggestion, but might be the easiest way to go w/o running around with Group Policy.
Sgt_B: They are not admins of the server box, but admins over the network. They need to retain all of the privledges of a domain admin, but not be able to modify permissions on a folder.
I will try putting them in a group and denying all privlidges to the folder, but I think that they can still modify the NTFS permissions on the folder and give themselves the right to that folder again.
The main thing I am trying to not allow is for them to take ownership of that folder.
They very well might be able to change the permissions. I'd like to see if it works though before venturing into GPOs. I'm a bit rusty with GPOs though so we'll see.
On second thought, even if they were denied access, they could simply remove themselves from the group, and presto, they got access. Try adding them as indivdual users to the deny list.
I'll look into this for ya, see if I can come up with anything.
For records sake, is this only one domain?, and are all admins in the Domain Admins group?
One domain. Yes, all admins are in the domain admin group. I inheirited this domain from the previous admin who did not do any documentation of the network.
I think the trick may be to separate the HR department into it's own separate ou, and then the rest of the company into another ou. Then give them admin rights to the within the rest of the company network, but only allow yourself or the head of HR (or a computer saavy HR person) to have admin rights to the HR ou.
You cannot restrict an administrator from doing anything on a machine that they have administrator access for.
http://support.microsoft.com/default...;en-us;Q240267
And if you remove the domain admin group from having administrator privileges. They can easily give it back to themselves with the following.
http://support.microsoft.com/default...;en-us;Q297307
I would suggest encrypting the data that you want to keep out of the hands of the domain admins with something like PGP.
DarkGuardian hit the nail right on the head! Once you have that set up, administration will be easy. Not sure what your exp. with AD is, but you might want to look into taking a class or two in regards to AD. It can be a great tool for a great many things.
Sgt_B: I am working on MCSE, so I do have general knowledge in AD. (Also have plenty of books) I will try DarkGuardian suggestion.
They should not be domain admins, because the built in group is designed for people who have complete, unrestricted access to everything in the domain. You can make it annoying for them to get at data, but they can always do it.
Denying them permissions does not work because they can take ownership. Denying the right to take ownership doesn't work because they can reset the rights back to a default setting.
Encryption will not work because they can name themself as a recovery agent and get encryption keys from any other user in the domain.
If you have people that you do want to be domain admins, dont put them in the group, make a junior admin group and give them appropriate rights or something along those lines.
Nothing worse then going into a network with nothing to go on. I take it that this is a WAN ? Not much to go on here but you can reduce privalages to other admins by using several options one set up a group of admins under a different group and password as well as permissions, second move the HR folder to it's own mapped drive, and use login scripts as to who sees the drive and then set the drive for password protection to login to that drive. Oh you can do this by creating a user with Admin rights exclusive to the drive. Best bet and fastest is to reduce privlages to other admins forget the group in W2K Backup Operators or perhaps power users. Can only be one Master Admin and other local admins should not have a problem with the policy. Good luck, sorry just so little to go on, just think to many cooks spoil the broth as do to many admins on a WAN policy has to come from the top and I hope you have their support.
Another thought is to simply give ownership to the folder to HR people, reduce everyone else to nothing including Admin no groups.
Im not to good with Active Directory yet, also working on it, But there is something called delegation. If you put these users in there own OU you can then have them act as domain administrators of a certain part of the active directory. I believe you have to delegate control to them. Again this is kinda what i picked up from reading books never actually tried it though but i believe it might work.
First rule of admining...never have your personal accounts have admin access. You should have to make a concious effort to make changes to machines that require admin access. Second rule of admining, never add accounts to Domain Admins, ever unless you want them to have complete access to everything in the domain. Third rule, if you don't listen to rule 1, then make a seperate OU/Security group for these other user's accounts and set the permissions with that security group.
Regards,
Wizeman
I agree that these people probably should not be domain admins. If they need to stay domain admins, your best bet is put the restricted files on an NTFS partition, set the permissions to keep the domain admins out, and then audit the crap out of it! If they change permissions/ownership, it's logged....if they create a user and access the files with that user, it's logged...if they muck around, and then clear the logs, that is also logged, so you can go back and say "you cleared the security log, and policy is logs are saved....where is the log file?"
Good luck
It will almost be impossible to restrict domain admins unless you use a GPO unfortunately. Like in my environment they use GPO's to restrict us domain admins from a lot of things including specific folders---there is always a way around it if you know what you're doing.
Take them out of the Domain Admin group, create a new group for them and give that group the explicit rights you want for them to be able to do, i.e. create groups, users, assign rights to certian OU's etc.
Do not allow them rights to create users, folders or change rights on the OU that the HR folder exists in. There is more to this, and not nearly as simple as I'm making it sound, but this is your only bet.
Even if you give those users an explicit deny access/no access to the HR folders since they are already Domain Admins (gods on your network) all they will have to do is take ownership of the folder and then give their users full rights to it again. There is no way you are keeping a domain admin out of anything in the domain because they have the rights to change those ACL's at any time they choose to, within that domain.
Good luck, and email me if you need any help on this. It's been a while since I have had to do something similar but I may be able to give you some suggestions and can be a good sounding board if you need one.
Also as grygst76 you can restrict access via GPO's but if they are in the Enterprise Admin group you will never keep them out. There are ways around GPO's but it's not easy.
El Diablo
All these different posts are confusing the issue... So once again to answer the original question. NO. You cannot restrict a domain administrator from a network share that is on a machine that is a member of said domain.
Creating different OUs doesn't do it for you, explicit denies will not do it, GPOs also will not do it for you.
You can remove the admins from the domain admin group, but hey.. then they can't do their job... Which is administration of the domain. You can add another domain to your forest, but somebody will still have administration priviledges of the root domain, and they can get around anything you put in place.
SO.. from my original reply.. The only solution given the information we have to work with.. Is to use some type of encryption program other then Win2k encryption, such as PGP. Then the admin can get to the file, but they can't read it.
mohaughn: OU's are the answer actually. OU's are designed to help break down the domain into more managable organizational units (OU's...) You can then delegate management/administration to each OU specfically. As DarkGuardian and El Diablo stated, you can delegate authority to the HR OU for the head network admin/hr person, and then delegate authority for the other admins in the other OU(s). This way they are not in the Domain Admins group, and thus do not have access to the HR OU or any of its resources. This way the administrators can do their job, and they do not have access to the HR OU.
I don't know enough about encryption, but shkuey wrote:
So the encryption method may be compromised as well.Quote:
Encryption will not work because they can name themself as a recovery agent and get encryption keys from any other user in the domain.
The method using AD and OU's will work, and should be the primary method used to delegate authority to various admins within your domain.
Umm.. He said in the original post that he wanted the domain admins to stay domain admins.
So given the original question. OUs do not work. Encryption does not work if you use the native win2k encryption.. Which is why in both of my messages I said to use PGP. There is no such thing as a DRA for PGP.
I think he'd like these admins to be able to do their job whether or not they're in the domain admins group or not. Assuming this, I know the OU's will work for what he needs. Like I said previously, I'm not an expert on encryption so I'm not sure how easy or difficult it would be for a domain admin to break in.
Either way, I know OU's would work in this situation. You seem to know that PGP encryption will work too. There are almost always different strategies to accomplish the same task.
So why argue? We all gave some good advice here.
Take care!
:D
Another after thought, fact is the original poster of the thread has not responded with any further information and much info has been given. A rather preplexing problem they set forth and so little info was given. Is it a WAN, how many servers, and the need for so many Admins on a network? Now the debate seems to be on how to get around Admin, humm. Just stuff to ponder well at least for me :)
Quote:
Originally posted here by Palemoon
Another after thought, fact is the original poster of the thread has not responded with any further information and much info has been given. A rather preplexing problem they set forth and so little info was given. Is it a WAN, how many servers, and the need for so many Admins on a network? Now the debate seems to be on how to get around Admin, humm. Just stuff to ponder well at least for me :)
Have you worked with Win2K much? There are tons of different things that must be done on a daily basis that require domain admin priviledges.. So somebody in the organization must be domain administrator. And usually that would not be someone in the HR department. Think about it. Do you want an HR type person being your domain admin, or do you want an IT specialist to be your domain admin? Ultimately, somebody has to be domain admin... I know the domain admins at my job would probably quit if you took domain admin rights away from them and told them that they would have to go talk to somebody in HR if they wanted to be able to do their job.
OUs are intended to be able to allow different organizations to manage their OU as they see fit. However, in this model there is always an organization that is responsible for administration of the domain(and that is not HR).
Some things only a domain admin can do: run domainprep, forestprep, install cluster servers(cluster service account must be domain admin in order for exchange to be installed in the cluster).. etc....
Like Palemoon said, we just don't know enough about this environment to make such judgments. Perhaps the underling admins do not need to be in the Domain Admins group. In order to do their jobs maybe all they need is to have admin priveleges to a certain OU. Or maybe they absolutely have to have Domain Admin privileges...you don't know that, and neither do I. There are plenty of organizations out there that use OU's just for the purpose of delegating authority to certain people in the IT/IS dept. Each admin has admin rights to his or her OU. Of course there's going to be one or two Domain Admins at the very top, but then there are going to be individuals or groups that control over each OU in their organization.
No arguement there...Quote:
OUs are intended to be able to allow different organizations to manage their OU as they see fit.
No...In this model there are two OU's. One for HR, and one for the rest of the domain. The other admin's would have rights, and be responsible for the second OU. The Lead/Senior Network Administrator would be responsible for actual domain/enterprise changes. (Thus handling HR administration as well.)Quote:
However, in this model there is always an organization that is responsible for administration of the domain(and that is not HR).
This is all about the company's security policy towards the HR department. Who should have access, who should manage, etc. If the comany policy says only these people will have access to these documents, then what would you do if the names on that list did not include your group of administrators?
This is a common practice in most medium/large/enterprise type environments. Think about it. Would you want 20-30 Domain Admins in your organization? Hell, I wouldn't even want 10! I'd have certain administrators handling the ins and outs of their specific OU's. This way when something happens, I know exactly who to go to. This is how plenty of people structure their networks with AD. Hell, why do you think this feature is in AD?
I've also done some very basic reading up on PGP. I did come across this SITE
It has to do with some security aspects of PGP. It seems to me that if a highly determined domain admin wanted to get at the data, then he/she could. Remember that a Domain Admin has full access to every single machine on the network. They could venture into the HR managers machine, and I'm sure (if they were malicious and deteremined enough) could find a way to bypass the PGP encryption.
All in all, network structuring depends on how the head of IT/IS wants to structure their Domain/Enterprise. It depends on security policy, and it depends on the environment.
Take Care!
:D