Re: Co-Administrator

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Thank you all for this, it is a great help.

- Les is right on target: so an Admin can take ownership of any given folder
if he purposely wants to, and that could not be accidental, but then I would
be aware of that if I wanted to. That's good enough for me, since that person
reports directly to me.

- Joe and Larry also provided very sensible advice, thanks. Yes, most of the
info is in Excel and Word format, so we could add another layer of security
there

"kj [SBS MVP]" wrote:

Les Connor [SBS MVP] wrote:
It's possible to deny access to any users, including administrators,
to any file or folder. You could have a folder or folders that only a
single individual user can access, whether that person is an
administrator or not.
What's not possible though, is to stop an administrator from taking
ownership of these files/folders, and then accessing them. By denying
access permissions, that would be enough to prevent 'accidental'
access. If there's a concern beyond that, then you could audit access
- but by the time you discovered a violation it would be too late.
There has to be a level of trust, otherwise you'll need to keep the
files elsewhere as others have suggested.

Taking ownership leaves a trail, and there are other stealthier ways an
administrator (domain) can just as easiily compromise anything on the system
/ domain. Even a non admin with physical access (and a little undisturbed
time) owns it all.

If an admin can't be trusted with the data, then you need a different admin.



"Charles" <Charles@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:07ECA812-C39E-4A01-83B2-9A864524AB34@xxxxxxxxxxxxxxxx
Hi,

I would like to grant admin rights with a young colleague so that he
can help me with all the IT stuff. Problem: there are certain shared
folder containing sensitive info that he cannot access now -- and I
would like it to
stay that way. Is there a simple way to give him enough rights to do
the IT
admin work, while keeping him from given shared folders?

So far this is what has kept me from granting him admin rights, so
any help
appreciated;

Charles

--
/kj



.

Relevant Pages

  • Re: Restrict take ownership rights
    ... If you could take away take ownership rights for only that folder (you ... I want to ensure that local administrators cannot come ... however they need local admin rights for some other reasons e.g. ...
    (microsoft.public.security)
  • Re: stupid mistake
    ... If you take ownership of the folder, which you should be able to do as the ... you will have the rights to redo the permissions. ... > admin or as an IT Admin. ...
    (microsoft.public.win2000.security)
  • Re: PF Admin tool & Administrative Rights
    ... Path in that server!! ... Actually I am testing with our lab server and the Ex admin path is ... I successfully received full information from the folder (size, ... If I add the same account as client member as owner, ...
    (microsoft.public.exchange2000.development)
  • Re: Help - corrupt Profile & unable to open files
    ... Last week my login profile got corrupted. ... Get the same message even as Admin. ... See if taking ownership of the folder and files helps. ... In Help and Support search on ownership or see this KB article. ...
    (microsoft.public.windowsxp.general)
  • Re: Stashing Temp Files Under Documents and SettingsAll Users?
    ... I just use the folder where the MDE resides. ... the Windows and Program Files folders) -- ... running as admin. ... install your Access front ends in user-writable storage space. ...
    (comp.databases.ms-access)